Initial Commit

2026-09-07 17:30:42 +02:00
commit 91dabffbd8
53 changed files with 5419 additions and 0 deletions
@@ -0,0 +1,4 @@
 ---
 exclude_paths:
 - .gitea/
@@ -0,0 +1,12 @@
 # EditorConfig is awesome: https://EditorConfig.org
 # top-most EditorConfig file
 root = true
 [*]
 indent_style = space
 indent_size = 2
 end_of_line = lf
 charset = utf-8
 trim_trailing_whitespace = true
 insert_final_newline = false
@@ -0,0 +1,20 @@
 name: Ansible Linter
 on:
  pull_request:
    types: [ "opened", "reopened", "synchronize" ]
  push:
    branches: [ '**' ]
    tags-ignore: [ '**' ]
 jobs:
  ansible-lint:
    runs-on:
    - ubuntu-latest
    steps:
    - uses: actions/checkout@v6.0.1
    - name: Run ansible-lint
      uses: ansible/ansible-lint@v26.1.0
      with:
        args: "--config-file .ansible-lint"
        setup_python: "true"
@@ -0,0 +1,18 @@
 name: Lint Markdown files
 on:
  pull_request:
    types: [ "opened", "reopened", "synchronize" ]
  push:
    branches: [ '**' ]
    tags-ignore: [ '**' ]
 jobs:
  markdown-lint:
    runs-on:
    - ubuntu-latest
    steps:
    - uses: actions/checkout@v6.0.1
    - uses: DavidAnson/markdownlint-cli2-action@v21.0.0
      with:
        globs: '**/*.md'
@@ -0,0 +1,22 @@
 name: Release Ansible Role
 on:
  push:
    tags:
    - '**'
  workflow_dispatch: {}
 jobs:
  release:
    name: Release Ansible Role
    runs-on: ubuntu-latest
    steps:
    - name: Install Ansible Galaxy
      run: |
        apt update --yes
        apt install --yes ansible
    - env:
        ANSIBLE_GALAXY_TOKEN: ${{ secrets.ANSIBLE_GALAXY_TOKEN }}
      name: Update Ansible Role in Ansible Galaxy
      run: |
        ansible-galaxy role import --token=${ANSIBLE_GALAXY_TOKEN} volker-raschek ${GITHUB_REPOSITORY#*/}
@@ -0,0 +1,2 @@
 .ansible
 node_modules
@@ -0,0 +1,137 @@
 # markdownlint YAML configuration
 # https://github.com/DavidAnson/markdownlint/blob/main/schema/.markdownlint.yaml
 # Default state for all rules
 default: true
 # Path to configuration file to extend
 extends: null
 # MD003/heading-style/header-style - Heading style
 MD003:
  # Heading style
  style: "atx"
 # MD004/ul-style - Unordered list style
 MD004:
  style: "dash"
 # MD007/ul-indent - Unordered list indentation
 MD007:
  # Spaces for indent
  indent: 2
  # Whether to indent the first level of the list
  start_indented: false
 # MD009/no-trailing-spaces - Trailing spaces
 MD009:
  # Spaces for line break
  br_spaces: 2
  # Allow spaces for empty lines in list items
  list_item_empty_lines: false
  # Include unnecessary breaks
  strict: false
 # MD010/no-hard-tabs - Hard tabs
 MD010:
  # Include code blocks
  code_blocks: true
 # MD012/no-multiple-blanks - Multiple consecutive blank lines
 MD012:
  # Consecutive blank lines
  maximum: 1
 # MD013/line-length - Line length
 MD013:
  # Number of characters
  line_length: 120
  # Number of characters for headings
  heading_line_length: 120
  # Number of characters for code blocks
  code_block_line_length: 120
  # Include code blocks
  code_blocks: false
  # Include tables
  tables: false
  # Include headings
  headings: true
  # Strict length checking
  strict: false
  # Stern length checking
  stern: false
 # MD022/blanks-around-headings/blanks-around-headers - Headings should be surrounded by blank lines
 MD022:
  # Blank lines above heading
  lines_above: 1
  # Blank lines below heading
  lines_below: 1
 # MD025/single-title/single-h1 - Multiple top-level headings in the same document
 MD025:
  # Heading level
  level: 1
  # RegExp for matching title in front matter
  front_matter_title: "^\\s*title\\s*[:=]"
 # MD026/no-trailing-punctuation - Trailing punctuation in heading
 MD026:
  # Punctuation characters
  punctuation: ".,;:!。，；：！"
 # MD029/ol-prefix - Ordered list item prefix
 MD029:
  # List style
  style: "one_or_ordered"
 # MD030/list-marker-space - Spaces after list markers
 MD030:
  # Spaces for single-line unordered list items
  ul_single: 1
  # Spaces for single-line ordered list items
  ol_single: 1
  # Spaces for multi-line unordered list items
  ul_multi: 1
  # Spaces for multi-line ordered list items
  ol_multi: 1
 # MD033/no-inline-html - Inline HTML
 MD033:
  # Allowed elements
  allowed_elements: []
 # MD035/hr-style - Horizontal rule style
 MD035:
  # Horizontal rule style
  style: "---"
 # MD036/no-emphasis-as-heading/no-emphasis-as-header - Emphasis used instead of a heading
 MD036:
  # Punctuation characters
  punctuation: ".,;:!?。，；：！？"
 # MD041/first-line-heading/first-line-h1 - First line in a file should be a top-level heading
 MD041:
  # Heading level
  level: 1
  # RegExp for matching title in front matter
  front_matter_title: "^\\s*title\\s*[:=]"
 # MD044/proper-names - Proper names should have the correct capitalization
 MD044:
  # List of proper names
  names:
  - gitea
  # Include code blocks
  code_blocks: false
 # MD046/code-block-style - Code block style
 MD046:
  # Block style
  style: "fenced"
 # MD048/code-fence-style - Code fence style
 MD048:
  # Code fence syle
  style: "backtick"
@@ -0,0 +1,14 @@
 {
  "ansible.python.interpreterPath": "/bin/python",
  "files.associations": {
    "**/.gitea/**/*.yml": "yaml",
    "**/.gitea/**/*.yaml": "yaml",
    "docker-compose*.yml": "dockercompose",
    "*.yml": "ansible",
    "*.yaml": "ansible",
    ".yamllint": "yaml",
    ".yamllint.yml": "yaml",
    ".yamllint.yaml": "yaml"
  },
  "rewrap.wrappingColumn": 120
 }
@@ -0,0 +1,19 @@
 ---
 #
 # Documentation:
 # https://yamllint.readthedocs.io/en/stable/
 #
 rules:
  brackets:
    forbid: false
    min-spaces-inside: 0
    max-spaces-inside: 2
    min-spaces-inside-empty: 0
    max-spaces-inside-empty: 0
  indentation:
    spaces: 2
    indent-sequences: false
  line-length:
    max: 360
@@ -0,0 +1,20 @@
 Copyright (c) 2026 Markus Pesch
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
 "Software"), to deal in the Software without restriction, including
 without limitation the rights to use, copy, modify, merge, publish,
 distribute, sublicense, and/or sell copies of the Software, and to
 permit persons to whom the Software is furnished to do so, subject to
 the following conditions:
 The above copyright notice and this permission notice shall be
 included in all copies or substantial portions of the Software.
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
 EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
 NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
 LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
 OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
 WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
@@ -0,0 +1,85 @@
 # certificate-authority
 This Ansible role can be used to create a root and intermediate certificate authority and issue client certificates from
 them. Additionally offers the ansible role the feature to import the certificates of the authority into the systems
 trust store.
 ## Examples
 The following minimal example creates a root and intermediate certificate authority and issues a client certificate from
 the intermediate certificate authority.
 ```yaml
 certificate_authority_client_skip: false
 certificate_authority_client_common_name: "{{ inventory_hostname }}"
 certificate_authority_client_subject_alternative_names:
 - "DNS:{{ inventory_hostname }}"
 - "DNS:san.example.local"
 - "IP:10.11.12.13"
 ```
 ## Parameters
 ### Root Certificate Authority (CA)
 | Name                                                      | Description                                                                                                                                   | Value                          |
 | --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ |
 | `certificate_authority_root_ca_skip`                      | Skip creation or import of a root certificate authority in general.                                                                           | `false`                        |
 | `certificate_authority_root_ca_create`                    | Create root certificate from scratch or import via `certificate_authority_root_ca_tls` prefixed variables.                                    | `true`                         |
 | `certificate_authority_root_ca_import`                    | Import the TLS certificate of the root certificate authority into the systems trust store.                                                    | `true`                         |
 | `certificate_authority_root_ca_path`                      | Directory where the private and public TLS key of the root certificate authority should be stored.                                            | `/etc/ansible-playbook/pki/ca` |
 | `certificate_authority_root_ca_common_name`               | Common Name (CN) of the root certificate authority.                                                                                           | `Ansible Root CA`              |
 | `certificate_authority_root_ca_country_name`              | Country name of the root certificate authority. For example `US`, `FR` or `DE`.                                                               | `""`                           |
 | `certificate_authority_root_ca_email_address`             | E-Mail Address of the root certificate authority owner.                                                                                       | `""`                           |
 | `certificate_authority_root_ca_organization_name`         | Organization name of the root certificate authority owner.                                                                                    | `""`                           |
 | `certificate_authority_root_ca_organizational_unit_name`  | Organizational unit name of the root certificate authority.                                                                                   | `""`                           |
 | `certificate_authority_root_ca_state_or_province_name`    | State or province name where the owner of the root certificate authority is located.                                                          | `""`                           |
 | `certificate_authority_root_ca_subject_alternative_names` | Subject Alternative Names (SAN) of the root certificate authority. Example: `DNS:example.local`, `IP:10.11.12.13`.                            | `[]`                           |
 | `certificate_authority_root_ca_not_after`                 | Time in the future from now when the TLS certificate should expire                                                                            | `+3650d`                       |
 | `certificate_authority_root_ca_not_before`                | Time in the past from now when the TLS certificate should be valid.                                                                           | `+0s`                          |
 | `certificate_authority_root_ca_tls_key_content`           | Content of a custom used root certificate authority. Will only be imported, when `certificate_authority_root_ca_create: false`.               | `""`                           |
 | `certificate_authority_root_ca_tls_crt_content`           | Content of a custom used certificate of the certificate authority. Will only be imported, when `certificate_authority_root_ca_create: false`. | `""`                           |
 | `certificate_authority_root_ca_tls_key_passphrase`        | Passphrase for the private key of the generated or imported root certificate authority.                                                       | `""`                           |
 | `certificate_authority_root_ca_tls_key_type`              | Algorithm of the private key of the root certificate authority.                                                                               | `RSA`                          |
 ### Intermediate Certificate Authority (CA)
 | Name                                                              | Description                                                                                                                                           | Value                                    |
 | ----------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------- |
 | `certificate_authority_intermediate_ca_skip`                      | Skip creation or import of a intermediate certificate authority in general.                                                                           | `false`                                  |
 | `certificate_authority_intermediate_ca_create`                    | Create intermediate certificate from scratch or import via `certificate_authority_intermediate_ca_tls` prefixed variables.                            | `true`                                   |
 | `certificate_authority_intermediate_ca_path`                      | Directory where the private and public TLS key of the intermediate certificate authority should be stored.                                            | `/etc/ansible-playbook/pki/intermediate` |
 | `certificate_authority_intermediate_ca_common_name`               | Common Name (CN) of the intermediate certificate authority.                                                                                           | `Ansible Intermediate CA`                |
 | `certificate_authority_intermediate_ca_country_name`              | Country name of the intermediate certificate authority. For example `US`, `FR` or `DE`.                                                               | `""`                                     |
 | `certificate_authority_intermediate_ca_email_address`             | E-Mail Address of the intermediate certificate authority owner.                                                                                       | `""`                                     |
 | `certificate_authority_intermediate_ca_organization_name`         | Organization name of the intermediate certificate authority owner.                                                                                    | `""`                                     |
 | `certificate_authority_intermediate_ca_organizational_unit_name`  | Organizational unit name of the intermediate certificate authority.                                                                                   | `""`                                     |
 | `certificate_authority_intermediate_ca_state_or_province_name`    | State or province name where the owner of the intermediate certificate authority is located.                                                          | `""`                                     |
 | `certificate_authority_intermediate_ca_subject_alternative_names` | Subject Alternative Names (SAN) of the intermediate certificate authority. Example: `DNS:example.local`, `IP:10.11.12.13`.                            | `[]`                                     |
 | `certificate_authority_intermediate_ca_not_after`                 | Time in the future from now when the TLS certificate should expire                                                                                    | `+1825d`                                 |
 | `certificate_authority_intermediate_ca_not_before`                | Time in the past from now when the TLS certificate should be valid.                                                                                   | `+0s`                                    |
 | `certificate_authority_intermediate_ca_tls_key_content`           | Content of a custom used intermediate certificate authority. Will only be imported, when `certificate_authority_intermediate_ca_create: false`.       | `""`                                     |
 | `certificate_authority_intermediate_ca_tls_crt_content`           | Content of a custom used certificate of the certificate authority. Will only be imported, when `certificate_authority_intermediate_ca_create: false`. | `""`                                     |
 | `certificate_authority_intermediate_ca_tls_key_passphrase`        | Passphrase for the private key of the generated or imported intermediate certificate authority.                                                       | `""`                                     |
 | `certificate_authority_intermediate_ca_tls_key_type`              | Algorithm of the private key of the intermediate certificate authority.                                                                               | `RSA`                                    |
 ### Client Certificate
 | Name                                                     | Description                                                                                                                               | Value                              |
 | -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------- |
 | `certificate_authority_client_skip`                      | Skip creation or import of a client certificate in general.                                                                               | `true`                             |
 | `certificate_authority_client_create`                    | Create client certificate from scratch or import via `certificate_authority_client_tls` prefixed variables.                               | `true`                             |
 | `certificate_authority_client_path`                      | Directory where the private and public TLS key of the client certificate authority should be stored.                                      | `/etc/ansible-playbook/pki/client` |
 | `certificate_authority_client_common_name`               | Common Name (CN) of the client certificate.                                                                                               | `Ansible Client Certificate`       |
 | `certificate_authority_client_country_name`              | Country name of the client certificate. For example `US`, `FR` or `DE`.                                                                   | `""`                               |
 | `certificate_authority_client_email_address`             | E-Mail Address of the client certificate owner.                                                                                           | `""`                               |
 | `certificate_authority_client_organization_name`         | Organization name of the client certificate owner.                                                                                        | `""`                               |
 | `certificate_authority_client_organizational_unit_name`  | Organizational unit name of the client certificate.                                                                                       | `""`                               |
 | `certificate_authority_client_state_or_province_name`    | State or province name where the owner of the client certificate is located.                                                              | `""`                               |
 | `certificate_authority_client_subject_alternative_names` | Subject Alternative Names (SAN) of the client certificate. Example: `DNS:example.local`, `IP:10.11.12.13`.                                | `[]`                               |
 | `certificate_authority_client_not_after`                 | Time in the future from now when the TLS certificate should expire                                                                        | `+397d`                            |
 | `certificate_authority_client_not_before`                | Time in the past from now when the TLS certificate should be valid.                                                                       | `+0s`                              |
 | `certificate_authority_client_tls_key_passphrase`        | Passphrase for the private key of the generated or imported client certificate.                                                           | `""`                               |
 | `certificate_authority_client_tls_key_type`              | Algorithm of the private key of the client certificate.                                                                                   | `RSA`                              |
 | `certificate_authority_client_tls_crt_content`           | Content of a custom used client certificate. Will only be imported, when `certificate_authority_client_create: false`.                    | `""`                               |
 | `certificate_authority_client_tls_key_content`           | Content of the private key of a custom used client certificate. Will only be imported, when `certificate_authority_client_create: false`. | `""`                               |
@@ -0,0 +1,982 @@
 ---
 ## @section Postfix configuration
 ## @param postfix_address_verify_db Lookup table URI for address verification. Postfix uses this table to verify recipient addresses before accepting mail for delivery.
 ## @param postfix_address_verify_negative_expire_time Time after which a failed probe expires from the address verification cache.
 ## @param postfix_address_verify_negative_refresh_time Time after which a failed address verification probe needs to be refreshed.
 ## @param postfix_address_verify_positive_expire_time Time after which a successful probe expires from the address verification cache.
 ## @param postfix_address_verify_positive_refresh_time Time after which a successful address verification probe needs to be refreshed.
 postfix_address_verify_db: "lmdb:/var/lib/postfix/verify_cache"
 postfix_address_verify_negative_expire_time: ""
 postfix_address_verify_negative_refresh_time: ""
 postfix_address_verify_positive_expire_time: ""
 postfix_address_verify_positive_refresh_time: ""
 ## @param postfix_alias_database [string] Alias database for local(8) delivery. Postfix uses this database to map email addresses to local recipients.
 ## @param postfix_alias_maps [string] Alias maps for local(8) delivery. Postfix uses this database to map email addresses to local recipients.
 postfix_alias_database_enabled: true
 postfix_alias_database_table: "lmdb:/etc/postfix/aliases"
 postfix_alias_database_entry_root: "root"
 postfix_alias_database_entries:
 - origin: "root"
  user: "{{ postfix_alias_database_entry_root }}"
 # Basic system aliases -- these MUST be present
 - origin: "MAILER-DAEMON"
  user: "postmaster"
 - origin: "postmaster"
  user: "root"
 # General redirection for pseudo-users to a real user. This is useful for system accounts that should not receive mail directly.
 - origin: "abuse"
  user: "root"
 - origin: "bin"
  user: "root"
 - origin: "clamav"
  user: "root"
 - origin: "daemon"
  user: "root"
 - origin: "ftp"
  user: "root"
 - origin: "hostmaster"
  user: "root"
 - origin: "named"
  user: "root"
 - origin: "news"
  user: "root"
 - origin: "nobody"
  user: "root"
 - origin: "postfix"
  user: "root"
 - origin: "security"
  user: "root"
 - origin: "usenet"
  user: "root"
 - origin: "uucp"
  user: "root"
 - origin: "virusalert"
  user: "root"
 - origin: "webmaster"
  user: "root"
 - origin: "www"
  user: "root"
 # Instead of bouncing 'noreply', we send it to /dev/null
 - origin: "noreply"
  user: "devnull"
 - origin: "devnull"
  user: "/dev/null"
 postfix_alias_maps: "{{ postfix_alias_database_table }}"
 postfix_alias_maps_table_entries: []
 ## @param postfix_append_at_myorigin Append the value of $myorigin to addresses that do not contain a domain part.
 postfix_append_at_myorigin: true
 ## @param postfix_append_dot_mydomain Append a dot and the value of $mydomain to addresses that do not contain a domain part.
 postfix_append_dot_mydomain: false
 ## @param postfix_biff Enable or disable the biff service, which notifies users of new mail. The default is false, which disables the service.
 postfix_biff: false
 ## @param postfix_canonical_maps [array] Address rewriting for both sender and recipient. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
 postfix_canonical_maps:
 - "{{ postfix_lmdb_canonical_maps_table if postfix_lmdb_enabled and postfix_lmdb_canonical_maps_enabled else '' }}"
 ## @param postfix_check_client_access_maps [array] Client access control tables. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
 postfix_check_client_access_maps:
 - "{{ postfix_lmdb_check_client_access_maps_table if postfix_lmdb_enabled and postfix_lmdb_check_client_access_maps_enabled else '' }}"
 ## @param postfix_check_helo_access_maps [array] HELO/EHLO access control tables. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
 postfix_check_helo_access_maps:
 - "{{ postfix_lmdb_check_helo_access_maps_table if postfix_lmdb_enabled and postfix_lmdb_check_helo_access_maps_enabled else '' }}"
 ## @param postfix_check_recipient_access_maps [array] Recipient access control tables. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
 postfix_check_recipient_access_maps:
 - "{{ postfix_lmdb_check_recipient_access_maps_table if postfix_lmdb_enabled and postfix_lmdb_check_recipient_access_maps_enabled else '' }}"
 ## @param postfix_check_sender_access_maps [array] Sender access control tables. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
 postfix_check_sender_access_maps:
 - "{{ postfix_lmdb_check_sender_access_maps_table if postfix_lmdb_enabled and postfix_lmdb_check_sender_access_maps_enabled else '' }}"
 ## @param postfix_compatibility_level The Postfix compatibility level. This parameter controls the behavior of certain Postfix features and settings to maintain compatibility with older versions of Postfix.
 postfix_compatibility_level: "3.11"
 ## @param postfix_delay_warning_time The time after which Postfix sends a warning message to the sender if a message is delayed in the queue.
 postfix_delay_warning_time: ""
 ## @param postfix_disable_vrfy_command Disable the VRFY command in the Postfix SMTP server.
 postfix_disable_vrfy_command: false
 ## @param postfix_home_mailbox The path to the mailbox for local users.
 postfix_home_mailbox: ""
 ## @param postfix_inet_interfaces The network interfaces that Postfix should listen on for incoming connections.
 postfix_inet_interfaces: ""
 ## @param postfix_inet_protocols The internet protocols that Postfix should use when making and accepting connections. Possible values: "all", "ipv4", "ipv6", "ipv4, ipv6", "ipv6, ipv4". The default is "all".
 postfix_inet_protocols: ""
 ## @param postfix_mailbox_size_limit The maximal size in bytes of an individual mailbox or maildir file, or zero (no limit). Use -1 to postfix build-in default.
 postfix_mailbox_size_limit: -1
 ## @param postfix_mail_name The name of the mail system. Leave empty to use postfix build-in default value.
 postfix_mail_name: ""
 ## @param postfix_mail_owner The user account that owns the Postfix daemon processes. Leave empty to use postfix build-in default value.
 postfix_mail_owner: ""
 ## @param postfix_message_size_limit The maximum size in bytes of a message that the Postfix SMTP server will accept. Use -1 to postfix build-in default.
 postfix_message_size_limit: -1
 ## @param postfix_milter_default_action The default action for the Postfix Milter (mail filter) library when a mail filter application does not respond. Possible values: "accept", "reject", "discard", "tempfail", "shutdown".
 postfix_milter_default_action: ""
 ## @param postfix_milter_mail_macros The macros that the Postfix Milter (mail filter) library should pass to the mail filter application.
 postfix_milter_mail_macros: ""
 ## @param postfix_milter_protocol The Milter protocol version to use. Leave empty to use postfix build-in default value.
 postfix_milter_protocol: ""
 ## @param postfix_mua_client_restrictions [array] Restrictions for the Postfix SMTP client when sending mail. The order is important, as the first match is used.
 postfix_mua_client_restrictions: []
 ## @param postfix_mua_relay_restrictions [array] Restrictions for the Postfix SMTP client when relaying mail. The order is important, as the first match is used.
 postfix_mua_relay_restrictions: []
 ## @param postfix_mua_sender_restrictions [array] Restrictions for the Postfix SMTP client when sending mail. The order is important, as the first match is used.
 postfix_mua_sender_restrictions: []
 ## @param postfix_mydestination [array] Domains that are delivered via the $local_transport mail delivery. The order is important, as the first match is used. The default configuration includes the mail server's hostname and localhost.
 postfix_mydestination: []
 ## @param postfix_mydomain [string] The internet domain name of this mail system. The default is to use the domain part of $myhostname.
 postfix_mydomain: "{{ inventory_hostname.split('.')[1:] | join('.') }}"
 ## @param postfix_myhostname [string] The internet hostname of this mail system. The default is to use the fully qualified domain name of the host.
 postfix_myhostname: "{{ inventory_hostname }}"
 ## @param postfix_mynetworks [array] Additional IP addresses or CIDR ranges to trust for relaying
 postfix_mynetworks: []
 ## @param postfix_mynetworks_style The method to generate the default value for the $mynetworks parameter. Possible values: "subnet", "host", "class", "hash", "static". Leave empty to use postfix build-in default value.
 postfix_mynetworks_style: ""
 ## @param postfix_myorigin The domain name that locally-posted mail appears to come from, and that locally-posted mail is delivered to. Leave empty to use postfix build-in default value.
 postfix_myorigin: ""
 ## @param postfix_non_smtpd_milters [array] A list of Milter (mail filter) applications for new mail that does not arrive via the Postfix smtpd(8) server. This includes local submission via the sendmail(1) command line, new mail that arrives via the Postfix qmqpd(8) server, and old mail that is re-injected into the queue with "postsuper -r".
 postfix_non_smtpd_milters: []
 ## @param postfix_proxy_interfaces Public IP address when Postfix runs behind a proxy or NAT
 postfix_proxy_interfaces: ""
 ## @param postfix_recipient_canonical_maps [array] Recipient address rewriting. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
 postfix_recipient_canonical_maps:
 - "{{ postfix_lmdb_recipient_canonical_maps_table if postfix_lmdb_enabled and postfix_lmdb_recipient_canonical_maps_enabled else '' }}"
 ## @param postfix_recipient_delimiter The character that separates the local part of an email address from the extension.
 postfix_recipient_delimiter: ""
 ## @param postfix_relay_domains [array] Domains for which this server acts as relay. The order is important, as the first match is used. The SMTP server validates recipient addresses with $relay_recipient_maps and rejects non-existent recipients. Empty items are filtered out by the template.
 postfix_relay_domains:
 - "{{ postfix_lmdb_relay_domains_table if postfix_lmdb_enabled and postfix_lmdb_relay_domains_enabled else '' }}"
 - "{{ postfix_pgsql_relay_domains_table if postfix_pgsql_enabled and postfix_pgsql_relay_domains_enabled else '' }}"
 ## @param postfix_relay_recipient_maps [array] Valid recipients in relay domains. The order is important, as the first match is used. Postfix needs to know only if a lookup string is found or not, but it does not use the result from table lookup. Empty items are filtered out by the template.
 postfix_relay_recipient_maps:
 - "{{ postfix_lmdb_relay_recipients_table if postfix_lmdb_enabled and postfix_lmdb_relay_recipients_enabled else '' }}"
 - "{{ postfix_pgsql_relay_recipient_maps_table if postfix_pgsql_enabled and postfix_pgsql_relay_recipient_maps_enabled else '' }}"
 ## @param postfix_relocated_maps [array] Contact information for relocated users. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
 postfix_relocated_maps:
 - "{{ postfix_lmdb_relocated_maps_table if postfix_lmdb_enabled and postfix_lmdb_relocated_maps_enabled else '' }}"
 ## @param postfix_sender_canonical_maps [array] Sender address rewriting. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
 postfix_sender_canonical_maps:
 - "{{ postfix_lmdb_sender_canonical_maps_table if postfix_lmdb_enabled and postfix_lmdb_sender_canonical_maps_enabled else '' }}"
 ## @param postfix_smtpd_forbid_bare_newline Forbid bare newline in SMTPD. Leave empty to use postfix build-in default value.
 postfix_smtpd_forbid_bare_newline: ""
 ## @param postfix_smtpd_forbid_bare_newline_exclusions [array] Exclude the specified clients from smtpd_forbid_bare_newline enforcement. Leave empty to use postfix build-in default value.
 postfix_smtpd_forbid_bare_newline_exclusions: ""
 ## @param postfix_smtp_sasl_password_maps [array] SMTP SASL password maps. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
 postfix_smtp_sasl_password_maps:
 - "{{ postfix_lmdb_smtp_sasl_password_maps_table if postfix_lmdb_enabled and postfix_lmdb_smtp_sasl_password_maps_enabled else '' }}"
 ## @param postfix_smtpd_sender_login_maps [array] SASL login names that own sender addresses. Assembled from enabled LMDB/PgSQL sources. Empty items are filtered out by the template.
 postfix_smtpd_sender_login_maps:
 - "{{ postfix_lmdb_smtpd_sender_login_maps_table if postfix_lmdb_enabled and postfix_lmdb_smtpd_sender_login_maps_enabled else '' }}"
 - "{{ postfix_pgsql_smtpd_sender_login_maps_table if postfix_pgsql_enabled and postfix_pgsql_smtpd_sender_login_maps_enabled else '' }}"
 ## @param postfix_relayhost Next-hop destination for non-local mail (e.g. "[smtp.example.com]:587")
 # postfix_relayhost: "[smtp.example.com]:587"
 ## @param postfix_smtp_sasl_auth_enable Enable SASL authentication for the Postfix SMTP client
 postfix_smtp_sasl_auth_enable: false
 ## @param postfix_smtp_tls_CAfile Path to the CA certificate file for the Postfix SMTP client. This file is used to verify the server's certificate when establishing a TLS connection.
 postfix_smtp_tls_capath: "/etc/ssl/certs"
 ## @param postfix_smtp_tls_cert_file Path to the TLS certificate file for the Postfix SMTP client. This file is used to authenticate the client when establishing a TLS connection.
 ## @param postfix_smtp_tls_key_file Path to the TLS private key file for the Postfix SMTP client. This file is used to authenticate the client when establishing a TLS connection.
 postfix_smtp_tls_cert_file: ""
 postfix_smtp_tls_key_file: ""
 ## @param postfix_smtp_tls_loglevel Log level for the Postfix SMTP client TLS. Possible values: 0 (no logging), 1 (log TLS negotiation), 2 (log TLS negotiation and session parameters), 3 (log TLS negotiation, session parameters, and certificate details). Use -1 to postfix build-in default.
 postfix_smtp_tls_loglevel: -1
 ## @param postfix_smtp_tls_mandatory_ciphers TLS ciphers for the Postfix SMTP client when mandatory TLS is required. Leave empty to use postfix build-in default value.
 postfix_smtp_tls_mandatory_ciphers: ""
 ## @param postfix_smtp_tls_mandatory_protocols TLS protocol versions for the Postfix SMTP client when mandatory TLS is required. Specify a space-separated list of protocols, e.g. "TLSv1.2 TLSv1.3".
 postfix_smtp_tls_mandatory_protocols: ">=TLSv1.2"
 ## @param postfix_smtp_tls_protocols TLS protocol versions for the Postfix SMTP client. Specify a space-separated list of protocols, e.g. "TLSv1.2 TLSv1.3".
 postfix_smtp_tls_protocols: ">=TLSv1.2"
 ## @param postfix_smtp_tls_security_level TLS security level for the Postfix SMTP client. Possible values: none, may, encrypt, dane, dane-only, fingerprint, verify, secure. Leave empty to use postfix build-in default value.
 postfix_smtp_tls_security_level: ""
 ## @param postfix_smtp_tls_session_cache_database Database for caching TLS sessions. Postfix uses this database to cache TLS session parameters for outgoing SMTP connections.
 postfix_smtp_tls_session_cache_database: "lmdb:/var/lib/postfix/smtp_scache"
 ## @section Postfix SMTP daemon configuration
 ## @param postfix_smtpd_banner The text that the Postfix SMTP server sends in response to the EHLO command. Leave empty to use postfix build-in default value.
 postfix_smtpd_banner: ""
 ## @param postfix_smtpd_data_restrictions [array] Restrictions for the Postfix SMTP server when processing the DATA command. The order is important, as the first match is used. The default configuration does not impose any restrictions on the DATA command.
 postfix_smtpd_data_restrictions: []
 ## @param postfix_smtpd_client_restrictions [array] Restrictions for the Postfix SMTP server when processing client connections. The order is important, as the first match is used. The default configuration allows relaying only from trusted networks and authenticated users, and rejects all other clients.
 postfix_smtpd_client_restrictions: []
 ## @param postfix_smtpd_end_of_data_restrictions [array] Restrictions for the Postfix SMTP server when processing the END-OF-DATA command. The order is important, as the first match is used. The default configuration does not impose any restrictions on the END-OF-DATA command.
 postfix_smtpd_end_of_data_restrictions: []
 ## @param postfix_smtpd_etrn_restrictions [array] Restrictions for the Postfix SMTP server when processing the ETRN command. The order is important, as the first match is used. The default configuration does not impose any restrictions on the ETRN command.
 postfix_smtpd_etrn_restrictions: []
 ## @param postfix_smtpd_helo_required Require that a remote SMTP client introduces itself with the HELO or EHLO command.
 postfix_smtpd_helo_required: false
 ## @param postfix_smtpd_helo_restrictions [array] Restrictions for the Postfix SMTP server when processing HELO/EHLO commands. The order is important, as the first match is used. The default configuration does not impose any restrictions on HELO/EHLO commands.
 postfix_smtpd_helo_restrictions: []
 ## @param postfix_smtpd_milters [array] A list of Milter (mail filter) applications for new mail that arrives via the Postfix smtpd(8) server. This includes mail that is submitted via the sendmail(1) command line, new mail that arrives via the Postfix qmqpd(8) server, and old mail that is re-injected into the queue with "postsuper -r".
 postfix_smtpd_milters: []
 ## @param postfix_smtpd_recipient_restrictions [array] Restrictions for the Postfix SMTP server when processing recipient addresses
 ## (RCPT TO). The order is important, as the first match is used. The check_*_access maps are automatically prepended by the
 ## template based on the postfix_check_*_access_maps variables.
 postfix_smtpd_recipient_restrictions: []
 ## @param postfix_smtpd_relay_restrictions [array] Restrictions for the Postfix SMTP server when relaying mail. The order is important, as the first match is used. Leave empty to use postfix build-in default value.
 postfix_smtpd_relay_restrictions: []
 ## @param postfix_smtpd_sasl_authenticated_header Add a header to messages that are submitted by authenticated users.
 postfix_smtpd_sasl_authenticated_header: false
 ## @param postfix_smtpd_sasl_auth_enable Enable SASL authentication in the Postfix SMTP server. By default, the Postfix SMTP server does not offer authentication to clients.
 postfix_smtpd_sasl_auth_enable: false
 ## @param postfix_smtpd_sasl_path The path to the Postfix SMTP server's SASL authentication socket. Leave empty to use postfix build-in default value.
 postfix_smtpd_sasl_path: ""
 ## @param postfix_smtpd_sasl_security_options SASL security options for the Postfix SMTP server. Leave empty to use postfix build-in default value.
 postfix_smtpd_sasl_security_options: []
 ## @param postfix_smtpd_sasl_tls_security_options SASL security options for the Postfix SMTP server when TLS is used.
 postfix_smtpd_sasl_tls_security_options: []
 ## @param postfix_smtpd_sasl_type The SASL plug-in type that the Postfix SMTP server should use for authentication. Leave empty to use postfix build-in default value.
 postfix_smtpd_sasl_type: ""
 ## @param postfix_smtpd_sender_restrictions [array] Restrictions for the Postfix SMTP server when processing sender addresses. The order is important, as the first match is used. The default configuration allows relaying only from trusted networks and authenticated users, and rejects all other clients.
 postfix_smtpd_sender_restrictions: []
 ## @param postfix_smtpd_tls_auth_only Require that clients use TLS when authenticating.
 postfix_smtpd_tls_auth_only: false
 ## @param postfix_smtpd_tls_CApath Path to the directory containing CA certificates for the Postfix SMTP server. This directory is used to verify client certificates when establishing a TLS connection.
 postfix_smtpd_tls_capath: "/etc/ssl/certs"
 ## @param postfix_smtpd_tls_loglevel Log level for the Postfix SMTP server TLS. Possible values: 0 (no logging), 1 (log TLS negotiation), 2 (log TLS negotiation and session parameters), 3 (log TLS negotiation, session parameters, and certificate details). Use -1 to postfix build-in default.
 postfix_smtpd_tls_loglevel: -1
 ## @param postfix_smtpd_tls_mandatory_ciphers TLS ciphers for the Postfix SMTP server when mandatory TLS is required. Leave empty to use postfix build-in default value.
 postfix_smtpd_tls_mandatory_ciphers: ""
 ## @param postfix_smtpd_tls_cert_file Path to the TLS certificate file for the Postfix SMTP server. This file is used to authenticate the server when establishing a TLS connection.
 ## @param postfix_smtpd_tls_key_file Path to the TLS private key file for the Postfix SMTP server. This file is used to authenticate the server when establishing a TLS connection.
 postfix_smtpd_tls_cert_file: ""
 postfix_smtpd_tls_key_file: ""
 ## @param postfix_smtpd_tls_mandatory_protocols TLS protocol versions for the Postfix SMTP server when mandatory TLS is required.
 postfix_smtpd_tls_mandatory_protocols: ">=TLSv1.2"
 ## @param postfix_smtpd_tls_protocols TLS protocol versions for the Postfix SMTP server.
 postfix_smtpd_tls_protocols: ">=TLSv1.2"
 ## @param postfix_smtpd_tls_security_level TLS security level for the Postfix SMTP server. Possible values: none, may, encrypt, dane, dane-only, fingerprint, verify, secure.
 postfix_smtpd_tls_security_level: "may"
 ## @param postfix_smtpd_tls_session_cache_database Database for caching TLS sessions. Postfix uses this database to cache TLS session parameters for incoming SMTP connections.
 postfix_smtpd_tls_session_cache_database: "lmdb:/var/lib/postfix/smtpd_scache"
 ## @param postfix_strict_rfc821_envelopes Require that addresses received in SMTP MAIL FROM and RCPT TO commands are valid according to RFC 821.
 postfix_strict_rfc821_envelopes: false
 ## @param postfix_tls_policy_maps [array] Per-destination TLS security policy. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
 postfix_tls_policy_maps:
 - "{{ postfix_lmdb_tls_policy_maps_table if postfix_lmdb_enabled and postfix_lmdb_tls_policy_maps_enabled else '' }}"
 ## @param postfix_tls_preempt_cipherlist Preempt the cipher list order with the server's preference.
 postfix_tls_preempt_cipherlist: false
 ## @param postfix_tls_ssl_options List or bit-mask of OpenSSL options to enable.
 postfix_tls_ssl_options: ""
 ## @param postfix_transport_maps [array] Custom transport routing rules. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
 postfix_transport_maps:
 - "{{ postfix_lmdb_transport_maps_table if postfix_lmdb_enabled and postfix_lmdb_transport_maps_enabled else '' }}"
 ## @param postfix_virtual_alias_domains [array] Virtual alias domains. Leave empty to use postfix build-in default value.
 postfix_virtual_alias_domains: ""
 ## @param postfix_virtual_alias_maps [array] Virtual alias address mappings. Assembled from enabled LMDB/PgSQL sources. Empty items are filtered out by the template.
 postfix_virtual_alias_maps:
 - "{{ postfix_lmdb_virtual_alias_maps_table if postfix_lmdb_enabled and postfix_lmdb_virtual_alias_maps_enabled else '' }}"
 - "{{ postfix_pgsql_virtual_alias_maps_table if postfix_pgsql_enabled and postfix_pgsql_virtual_alias_maps_enabled else '' }}"
 - "{{ postfix_pgsql_virtual_alias_domain_maps_table if postfix_pgsql_enabled and postfix_pgsql_virtual_alias_maps_enabled else '' }}"
 - "{{ postfix_pgsql_virtual_alias_domain_catchall_maps_table if postfix_pgsql_enabled and postfix_pgsql_virtual_alias_maps_enabled else '' }}"
 ## @param postfix_virtual_mailbox_domains [array] Virtual mailbox domains. Assembled from enabled LMDB/PgSQL sources. Empty items are filtered out by the template.
 postfix_virtual_mailbox_domains:
 - "{{ postfix_lmdb_virtual_mailbox_domains_table if postfix_lmdb_enabled and postfix_lmdb_virtual_mailbox_domains_enabled else '' }}"
 - "{{ postfix_pgsql_virtual_mailbox_domains_table if postfix_pgsql_enabled and postfix_pgsql_virtual_mailbox_domains_enabled else '' }}"
 ## @param postfix_virtual_mailbox_limit The maximal size in bytes of an individual virtual(8) mailbox or maildir file, or zero (no limit). Use -1 to postfix build-in default.
 postfix_virtual_mailbox_limit: -1
 ## @param postfix_virtual_mailbox_maps [array] Valid virtual mailbox addresses. Assembled from enabled LMDB/PgSQL sources. Empty items are filtered out by the template.
 postfix_virtual_mailbox_maps:
 - "{{ postfix_lmdb_virtual_mailbox_maps_table if postfix_lmdb_enabled and postfix_lmdb_virtual_mailbox_maps_enabled else '' }}"
 - "{{ postfix_pgsql_virtual_mailbox_maps_table if postfix_pgsql_enabled and postfix_pgsql_virtual_mailbox_maps_enabled else '' }}"
 - "{{ postfix_pgsql_virtual_alias_domain_mailbox_maps_table if postfix_pgsql_enabled and postfix_pgsql_virtual_mailbox_maps_enabled else '' }}"
 ## @param postfix_virtual_transport The transport method for virtual mailboxes. For example via tcp, lmtp:[127.0.0.1] or unix socket lmtp:unix:private/lmpt-sock. Leave empty to use postfix build-in default value.
 postfix_virtual_transport: ""
 ## @section LMDB integration
 ## @param postfix_lmdb_enabled Enable LMDB lookup tables for virtual maps
 postfix_lmdb_enabled: false
 ## @param postfix_lmdb_canonical_maps_enabled Enable LMDB canonical maps lookup table.
 ## @param postfix_lmdb_canonical_maps_table LMDB lookup table URI for canonical maps.
 ## @param postfix_lmdb_canonical_maps_table_entries [array] Address rewriting entries for both sender and recipient
 ## @param postfix_lmdb_canonical_maps_table_entries[].origin Original address or domain pattern
 ## @param postfix_lmdb_canonical_maps_table_entries[].replacement Replacement address or domain
 postfix_lmdb_canonical_maps_enabled: false
 postfix_lmdb_canonical_maps_table: "lmdb:/etc/postfix/canonical_maps"
 postfix_lmdb_canonical_maps_table_entries: []
 # - origin: "user@ugly.domain"
 #   replacement: "user@pretty.domain"
 # - origin: "@old.domain"
 #   replacement: "@new.domain"
 ## @param postfix_lmdb_check_client_access_maps_enabled Enable LMDB check_client_access lookup table.
 ## @param postfix_lmdb_check_client_access_maps_table LMDB lookup table URI for client access control.
 ## @param postfix_lmdb_check_client_access_maps_table_entries [array] Access control entries by client hostname or IP
 ## @param postfix_lmdb_check_client_access_maps_table_entries[].pattern Hostname, domain, IP address or CIDR range
 ## @param postfix_lmdb_check_client_access_maps_table_entries[].action Action to take (OK, REJECT, DUNNO, INFO)
 ## @param postfix_lmdb_check_client_access_maps_table_entries[].reason [optional] Custom message (used with REJECT or INFO)
 postfix_lmdb_check_client_access_maps_enabled: false
 postfix_lmdb_check_client_access_maps_table: "lmdb:/etc/postfix/check_client_access_maps"
 postfix_lmdb_check_client_access_maps_table_entries: []
 # - pattern: "example.local"
 #   action: "OK"
 # - pattern: "123.123.123.0/24"
 #   action: "REJECT"
 #   reason: "Spam source"
 ## @param postfix_lmdb_check_helo_access_maps_enabled Enable LMDB check_helo_access lookup table.
 ## @param postfix_lmdb_check_helo_access_maps_table LMDB lookup table URI for HELO/EHLO access control.
 ## @param postfix_lmdb_check_helo_access_maps_table_entries [array] Access control entries by HELO/EHLO hostname
 ## @param postfix_lmdb_check_helo_access_maps_table_entries[].pattern Hostname, domain, IP address or CIDR range
 ## @param postfix_lmdb_check_helo_access_maps_table_entries[].action Action to take (OK, REJECT, DUNNO, INFO)
 ## @param postfix_lmdb_check_helo_access_maps_table_entries[].reason [optional] Custom message (used with REJECT or INFO)
 postfix_lmdb_check_helo_access_maps_enabled: false
 postfix_lmdb_check_helo_access_maps_table: "lmdb:/etc/postfix/check_helo_access_maps"
 postfix_lmdb_check_helo_access_maps_table_entries: []
 # - pattern: "spoofed.domain"
 #   action: "REJECT"
 #   reason: "Forged HELO"
 # - pattern: "trusted.domain"
 #   action: "OK"
 ## @param postfix_lmdb_check_recipient_access_maps_enabled Enable LMDB check_recipient_access lookup table.
 ## @param postfix_lmdb_check_recipient_access_maps_table LMDB lookup table URI for recipient access control.
 ## @param postfix_lmdb_check_recipient_access_maps_table_entries [array] Access control entries by recipient address
 ## @param postfix_lmdb_check_recipient_access_maps_table_entries[].pattern Email address, localpart@ or domain
 ## @param postfix_lmdb_check_recipient_access_maps_table_entries[].action Action to take (OK, REJECT, DUNNO, INFO)
 ## @param postfix_lmdb_check_recipient_access_maps_table_entries[].reason [optional] Custom message (used with REJECT or INFO)
 postfix_lmdb_check_recipient_access_maps_enabled: false
 postfix_lmdb_check_recipient_access_maps_table: "lmdb:/etc/postfix/check_recipient_access_maps"
 postfix_lmdb_check_recipient_access_maps_table_entries: []
 # - pattern: "postmaster@example.local"
 #   action: "OK"
 # - pattern: "blocked@example.local"
 #   action: "REJECT"
 #   reason: "Mailbox disabled"
 ## @param postfix_lmdb_check_sender_access_maps_enabled Enable LMDB check_sender_access lookup table.
 ## @param postfix_lmdb_check_sender_access_maps_table LMDB lookup table URI for sender access control.
 ## @param postfix_lmdb_check_sender_access_maps_table_entries [array] Access control entries by sender address
 ## @param postfix_lmdb_check_sender_access_maps_table_entries[].pattern Email address, localpart@ or domain
 ## @param postfix_lmdb_check_sender_access_maps_table_entries[].action Action to take (OK, REJECT, DUNNO, INFO)
 ## @param postfix_lmdb_check_sender_access_maps_table_entries[].reason [optional] Custom message (used with REJECT or INFO)
 postfix_lmdb_check_sender_access_maps_enabled: false
 postfix_lmdb_check_sender_access_maps_table: "lmdb:/etc/postfix/check_sender_access_maps"
 postfix_lmdb_check_sender_access_maps_table_entries: []
 # - pattern: "spammer@example.local"
 #   action: "REJECT"
 #   reason: "Sender blocked"
 # - pattern: ".trusted.domain"
 #   action: "OK"
 ## @param postfix_lmdb_recipient_canonical_maps_enabled Enable LMDB recipient canonical maps lookup table.
 ## @param postfix_lmdb_recipient_canonical_maps_table LMDB lookup table URI for recipient canonical maps.
 ## @param postfix_lmdb_recipient_canonical_maps_table_entries [array] Recipient address rewriting entries
 ## @param postfix_lmdb_recipient_canonical_maps_table_entries[].origin Original recipient address or domain
 ## @param postfix_lmdb_recipient_canonical_maps_table_entries[].replacement Replacement recipient address or domain
 postfix_lmdb_recipient_canonical_maps_enabled: false
 postfix_lmdb_recipient_canonical_maps_table: "lmdb:/etc/postfix/recipient_canonical_maps"
 postfix_lmdb_recipient_canonical_maps_table_entries: []
 # - origin: "old-user@example.local"
 #   replacement: "new-user@example.local"
 # - origin: "@old.domain"
 #   replacement: "@new.domain"
 ## @param postfix_lmdb_relay_domains_enabled Enable LMDB relay domain lookup table.
 ## @param postfix_lmdb_relay_domains_table LMDB lookup table URI for relay domains.
 ## @param postfix_lmdb_relay_domains_table_entries [array] Domains for which this server acts as relay
 ## @param postfix_lmdb_relay_domains_table_entries[].domain Domain or subdomain pattern to match
 ## @param postfix_lmdb_relay_domains_table_entries[].action Action to take (OK, REJECT, DUNNO, etc.)
 ## @param postfix_lmdb_relay_domains_table_entries[].reason [optional] Custom rejection message (only used with REJECT)
 postfix_lmdb_relay_domains_enabled: false
 postfix_lmdb_relay_domains_table: "lmdb:/etc/postfix/relay_domain_maps"
 postfix_lmdb_relay_domains_table_entries: []
 # - domain: "example.com"
 #   action: "OK"
 # - domain: ".example.com"
 #   action: "OK"
 # - domain: "untrusted.org"
 #   action: "REJECT"
 #   reason: "No relay for this domain"
 ## @param postfix_lmdb_relay_recipients_enabled Enable LMDB relay recipient lookup table.
 ## @param postfix_lmdb_relay_recipients_table LMDB lookup table URI for relay recipients.
 ## @param postfix_lmdb_relay_recipients_table_entries [array] Valid recipients in relay domains
 ## @param postfix_lmdb_relay_recipients_table_entries[].recipient Recipient address or @domain wildcard
 ## @param postfix_lmdb_relay_recipients_table_entries[].action Action to take (OK, REJECT, DUNNO, etc.)
 ## @param postfix_lmdb_relay_recipients_table_entries[].reason [optional] Custom rejection message (only used with REJECT)
 postfix_lmdb_relay_recipients_enabled: false
 postfix_lmdb_relay_recipients_table: "lmdb:/etc/postfix/relay_recipient_maps"
 postfix_lmdb_relay_recipients_table_entries: []
 # - recipient: "@example.com"
 #   action: "OK"
 # - recipient: "admin@example.com"
 #   action: "OK"
 # - recipient: "spammer@example.com"
 #   action: "REJECT"
 #   reason: "User unknown"
 ## @param postfix_lmdb_relocated_maps_enabled Enable LMDB relocated maps lookup table.
 ## @param postfix_lmdb_relocated_maps_table LMDB lookup table URI for relocated maps.
 ## @param postfix_lmdb_relocated_maps_table_entries [array] Contact information for relocated users
 ## @param postfix_lmdb_relocated_maps_table_entries[].old_address Former address that no longer exists
 ## @param postfix_lmdb_relocated_maps_table_entries[].new_address New contact address for the user
 postfix_lmdb_relocated_maps_enabled: false
 postfix_lmdb_relocated_maps_table: "lmdb:/etc/postfix/relocated_maps"
 postfix_lmdb_relocated_maps_table_entries: []
 # - old_address: "alice@example.local"
 #   new_address: "alice@newdomain.local"
 # - old_address: "bob@example.local"
 #   new_address: "bob@otherdomain.local"
 ## @param postfix_lmdb_sender_canonical_maps_enabled Enable LMDB sender canonical maps lookup table.
 ## @param postfix_lmdb_sender_canonical_maps_table LMDB lookup table URI for sender canonical maps.
 ## @param postfix_lmdb_sender_canonical_maps_table_entries [array] Sender address rewriting entries
 ## @param postfix_lmdb_sender_canonical_maps_table_entries[].origin Original sender address or domain
 ## @param postfix_lmdb_sender_canonical_maps_table_entries[].replacement Replacement sender address or domain
 postfix_lmdb_sender_canonical_maps_enabled: false
 postfix_lmdb_sender_canonical_maps_table: "lmdb:/etc/postfix/sender_canonical_maps"
 postfix_lmdb_sender_canonical_maps_table_entries: []
 # - origin: "user@ugly.domain"
 #   replacement: "user@pretty.domain"
 # - origin: "@internal.domain"
 #   replacement: "@public.domain"
 ## @param postfix_lmdb_smtp_sasl_password_maps_enabled Enable LMDB SMTP SASL password maps lookup table.
 ## @param postfix_lmdb_smtp_sasl_password_maps_table LMDB lookup table URI for SMTP SASL password maps.
 ## @param postfix_lmdb_smtp_sasl_password_maps_table_entries [array] SASL credentials for relay host authentication
 ## @param postfix_lmdb_smtp_sasl_password_maps_table_entries[].destination Relay host or domain to authenticate against
 ## @param postfix_lmdb_smtp_sasl_password_maps_table_entries[].username SASL username
 ## @param postfix_lmdb_smtp_sasl_password_maps_table_entries[].password SASL password
 postfix_lmdb_smtp_sasl_password_maps_enabled: false
 postfix_lmdb_smtp_sasl_password_maps_table: "lmdb:/etc/postfix/sasl_password_maps"
 postfix_lmdb_smtp_sasl_password_maps_table_entries: []
 # - destination: "[smtp.example.com]:587"
 #   username: "user"
 #   password: "secret"
 ## @param postfix_lmdb_smtpd_sender_login_maps_enabled Enable LMDB sender login lookup table.
 ## @param postfix_lmdb_smtpd_sender_login_maps_table LMDB lookup table URI for sender login maps.
 ## @param postfix_lmdb_smtpd_sender_login_maps_table_entries [array] SASL login names that own sender addresses
 ## @param postfix_lmdb_smtpd_sender_login_maps_table_entries[].address Sender address (user@domain, user, or @domain)
 ## @param postfix_lmdb_smtpd_sender_login_maps_table_entries[].login SASL login name that owns the address
 postfix_lmdb_smtpd_sender_login_maps_enabled: false
 postfix_lmdb_smtpd_sender_login_maps_table: "lmdb:/etc/postfix/smtpd_sender_login_maps"
 postfix_lmdb_smtpd_sender_login_maps_table_entries: []
 # - address: "user@example.com"
 #   login: "user@example.com"
 # - address: "@example.com"
 #   login: "admin@example.com"
 ## @param postfix_lmdb_tls_policy_maps_enabled Enable LMDB TLS policy maps lookup table.
 ## @param postfix_lmdb_tls_policy_maps_table LMDB lookup table URI for TLS policy maps.
 ## @param postfix_lmdb_tls_policy_maps_table_entries [array] Per-destination TLS security policy
 ## @param postfix_lmdb_tls_policy_maps_table_entries[].destination Domain, subdomain or [host]:port pattern
 ## @param postfix_lmdb_tls_policy_maps_table_entries[].policy TLS policy level (none, may, encrypt, verify, secure)
 postfix_lmdb_tls_policy_maps_enabled: false
 postfix_lmdb_tls_policy_maps_table: "lmdb:/etc/postfix/tls_policy_maps"
 postfix_lmdb_tls_policy_maps_table_entries: []
 # - destination: "example.com"
 #   policy: "encrypt"
 # - destination: "[mail.example.org]:587"
 #   policy: "secure match=nexthop"
 ## @param postfix_lmdb_transport_maps_enabled Enable LMDB transport maps lookup table.
 ## @param postfix_lmdb_transport_maps_table LMDB lookup table URI for transport maps.
 ## @param postfix_lmdb_transport_maps_table_entries [array] Custom transport routing rules
 ## @param postfix_lmdb_transport_maps_table_entries[].pattern Domain or address pattern to match
 ## @param postfix_lmdb_transport_maps_table_entries[].transport Transport and next-hop destination
 postfix_lmdb_transport_maps_enabled: false
 postfix_lmdb_transport_maps_table: "lmdb:/etc/postfix/transport_maps"
 postfix_lmdb_transport_maps_table_entries: []
 # - pattern: "example.com"
 #   transport: "smtp:[192.168.178.14]:25"
 # - pattern: ".example.com"
 #   transport: "smtp:[192.168.178.14]:25"
 ## @param postfix_lmdb_virtual_alias_maps_enabled Enable LMDB virtual alias lookup table.
 ## @param postfix_lmdb_virtual_alias_maps_table LMDB lookup table URI for virtual alias maps.
 ## @param postfix_lmdb_virtual_alias_maps_table_entries [array] Virtual alias address mappings
 ## @param postfix_lmdb_virtual_alias_maps_table_entries[].source Source address or @domain pattern
 ## @param postfix_lmdb_virtual_alias_maps_table_entries[].destination Destination address to forward to
 postfix_lmdb_virtual_alias_maps_enabled: false
 postfix_lmdb_virtual_alias_maps_table: "lmdb:/etc/postfix/virtual_alias_maps"
 postfix_lmdb_virtual_alias_maps_table_entries: []
 # - source: "info@example.com"
 #   destination: "admin@example.com"
 # - source: "@example.com"
 #   destination: "catchall@example.com"
 ## @param postfix_lmdb_virtual_mailbox_domains_enabled Enable LMDB virtual mailbox domain lookup table.
 ## @param postfix_lmdb_virtual_mailbox_domains_table LMDB lookup table URI for virtual mailbox domains.
 ## @param postfix_lmdb_virtual_mailbox_domains_table_entries [array] Virtual mailbox domain entries
 ## @param postfix_lmdb_virtual_mailbox_domains_table_entries[].domain Domain name
 ## @param postfix_lmdb_virtual_mailbox_domains_table_entries[].action Action (typically OK)
 postfix_lmdb_virtual_mailbox_domains_enabled: false
 postfix_lmdb_virtual_mailbox_domains_table: "lmdb:/etc/postfix/virtual_mailbox_domains"
 postfix_lmdb_virtual_mailbox_domains_table_entries: []
 # - domain: "example.com"
 #   action: "OK"
 # - domain: "other.com"
 #   action: "OK"
 ## @param postfix_lmdb_virtual_mailbox_maps_enabled Enable LMDB virtual mailbox maps lookup table.
 ## @param postfix_lmdb_virtual_mailbox_maps_table LMDB lookup table URI for virtual mailbox maps.
 ## @param postfix_lmdb_virtual_mailbox_maps_table_entries [array] Valid virtual mailbox addresses
 ## @param postfix_lmdb_virtual_mailbox_maps_table_entries[].address Email address or @domain pattern
 ## @param postfix_lmdb_virtual_mailbox_maps_table_entries[].action Action (typically OK)
 postfix_lmdb_virtual_mailbox_maps_enabled: false
 postfix_lmdb_virtual_mailbox_maps_table: "lmdb:/etc/postfix/virtual_mailbox_maps"
 postfix_lmdb_virtual_mailbox_maps_table_entries: []
 # - address: "user@example.com"
 #   action: "OK"
 # - address: "@example.com"
 #   action: "OK"
 ## @section PostgreSQL integration
 ## @param postfix_pgsql_enabled Enable PostgreSQL lookup tables for virtual maps
 ## @param postfix_pgsql_username PostgreSQL database user for Postfix lookups
 ## @param postfix_pgsql_password PostgreSQL database password for Postfix lookups
 ## @param postfix_pgsql_host PostgreSQL database host
 ## @param postfix_pgsql_port PostgreSQL database port
 ## @param postfix_pgsql_name PostgreSQL database name
 postfix_pgsql_enabled: false
 postfix_pgsql_username: ""
 postfix_pgsql_password: ""
 postfix_pgsql_host: "localhost"
 postfix_pgsql_port: 5432
 postfix_pgsql_name: "postfix"
 ## @param postfix_pgsql_relay_domains_enabled Enable PostgreSQL relay domain lookup.
 ## @param postfix_pgsql_relay_domains_table PostgreSQL lookup table URI for relay domains.
 ## @param postfix_pgsql_relay_domains_query SQL query to check if a domain is a relay domain.
 postfix_pgsql_relay_domains_enabled: false
 postfix_pgsql_relay_domains_table: "proxy:pgsql:/etc/postfix/pgsql_relay_domain_maps.cf"
 postfix_pgsql_relay_domains_query: ""
 ## @param postfix_pgsql_relay_recipient_maps_enabled Enable PostgreSQL relay recipient lookup.
 ## @param postfix_pgsql_relay_recipient_maps_table PostgreSQL lookup table URI for relay recipients.
 ## @param postfix_pgsql_relay_recipient_maps_query SQL query to check if a recipient is valid in a relay domain.
 postfix_pgsql_relay_recipient_maps_enabled: false
 postfix_pgsql_relay_recipient_maps_table: "proxy:pgsql:/etc/postfix/pgsql_relay_recipient_maps.cf"
 postfix_pgsql_relay_recipient_maps_query: ""
 ## @param postfix_pgsql_smtpd_sender_login_maps_enabled Enable PostgreSQL sender login lookup.
 ## @param postfix_pgsql_smtpd_sender_login_maps_table PostgreSQL lookup table URI for sender login maps.
 ## @param postfix_pgsql_smtpd_sender_login_maps_query SQL query to map sender addresses to login names.
 postfix_pgsql_smtpd_sender_login_maps_enabled: false
 postfix_pgsql_smtpd_sender_login_maps_table: "proxy:pgsql:/etc/postfix/pgsql_sender_login_maps.cf"
 postfix_pgsql_smtpd_sender_login_maps_query: ""
 ## @param postfix_pgsql_virtual_alias_maps_enabled Enable PostgreSQL virtual alias lookup.
 ## @param postfix_pgsql_virtual_alias_maps_table PostgreSQL lookup table URI for virtual alias maps.
 ## @param postfix_pgsql_virtual_alias_maps_query SQL query for virtual alias resolution.
 postfix_pgsql_virtual_alias_maps_enabled: false
 postfix_pgsql_virtual_alias_maps_table: "proxy:pgsql:/etc/postfix/pgsql_virtual_alias_maps.cf"
 postfix_pgsql_virtual_alias_maps_query: ""
 ## @param postfix_pgsql_virtual_alias_domain_maps_enabled Enable PostgreSQL virtual alias domain lookup.
 ## @param postfix_pgsql_virtual_alias_domain_maps_table PostgreSQL lookup table URI for virtual alias domain maps.
 ## @param postfix_pgsql_virtual_alias_domain_maps_query SQL query for virtual alias domain resolution. The query should return a single row with a single column named "FORWARD TO".
 postfix_pgsql_virtual_alias_domain_maps_enabled: false
 postfix_pgsql_virtual_alias_domain_maps_table: "proxy:pgsql:/etc/postfix/pgsql_virtual_alias_domain_maps.cf"
 postfix_pgsql_virtual_alias_domain_maps_query: ""
 ## @param postfix_pgsql_virtual_alias_domain_catchall_maps_enabled Enable PostgreSQL virtual alias domain catchall lookup.
 ## @param postfix_pgsql_virtual_alias_domain_catchall_maps_table PostgreSQL lookup table URI for virtual alias domain catchall maps.
 ## @param postfix_pgsql_virtual_alias_domain_catchall_maps_query SQL query for virtual alias domain catchall resolution. The query should return a single row with a single column named "FORWARD TO".
 postfix_pgsql_virtual_alias_domain_catchall_maps_enabled: false
 postfix_pgsql_virtual_alias_domain_catchall_maps_table: "proxy:pgsql:/etc/postfix/pgsql_virtual_alias_domain_catchall_maps.cf"
 postfix_pgsql_virtual_alias_domain_catchall_maps_query: ""
 ## @param postfix_pgsql_virtual_alias_domain_mailbox_maps_enabled Enable PostgreSQL virtual alias domain mailbox lookup.
 ## @param postfix_pgsql_virtual_alias_domain_mailbox_maps_table PostgreSQL lookup table URI for virtual alias domain mailbox maps.
 ## @param postfix_pgsql_virtual_alias_domain_mailbox_maps_query SQL query for virtual alias domain mailbox resolution. The query should return a single row with a single column named "FORWARD".
 postfix_pgsql_virtual_alias_domain_mailbox_maps_enabled: false
 postfix_pgsql_virtual_alias_domain_mailbox_maps_table: "proxy:pgsql:/etc/postfix/pgsql_virtual_alias_domain_mailbox_maps.cf"
 postfix_pgsql_virtual_alias_domain_mailbox_maps_query: ""
 ## @param postfix_pgsql_virtual_mailbox_domains_enabled Enable PostgreSQL virtual mailbox domain lookup.
 ## @param postfix_pgsql_virtual_mailbox_domains_table PostgreSQL lookup table URI for virtual mailbox domains.
 ## @param postfix_pgsql_virtual_mailbox_domains_query SQL query for virtual mailbox domain validation.
 postfix_pgsql_virtual_mailbox_domains_enabled: false
 postfix_pgsql_virtual_mailbox_domains_table: "proxy:pgsql:/etc/postfix/pgsql_virtual_mailbox_domains.cf"
 postfix_pgsql_virtual_mailbox_domains_query: ""
 ## @param postfix_pgsql_virtual_mailbox_maps_enabled Enable PostgreSQL virtual mailbox maps lookup.
 ## @param postfix_pgsql_virtual_mailbox_maps_table PostgreSQL lookup table URI for virtual mailbox maps.
 ## @param postfix_pgsql_virtual_mailbox_maps_query SQL query for virtual mailbox validation.
 postfix_pgsql_virtual_mailbox_maps_enabled: false
 postfix_pgsql_virtual_mailbox_maps_table: "proxy:pgsql:/etc/postfix/pgsql_virtual_mailbox_maps.cf"
 postfix_pgsql_virtual_mailbox_maps_query: ""
 ## @param postfix_pgsql_virtual_mailbox_limit_maps_enabled Enable PostgreSQL virtual mailbox limit lookup.
 ## @param postfix_pgsql_virtual_mailbox_limit_maps_table PostgreSQL lookup table URI for virtual mailbox limit maps.
 ## @param postfix_pgsql_virtual_mailbox_limit_maps_query SQL query for virtual mailbox limit retrieval. The query should return a single row with a single column named "QUOTA"
 postfix_pgsql_virtual_mailbox_limit_maps_enabled: false
 postfix_pgsql_virtual_mailbox_limit_maps_table: "proxy:pgsql:/etc/postfix/pgsql_virtual_mailbox_limit_maps.cf"
 postfix_pgsql_virtual_mailbox_limit_maps_query: ""
 ## @section Regular expression maps
 ## @param postfix_regexp_enabled Enable regular expression lookup tables for virtual maps
 postfix_regexp_enabled: false
 ## @param postfix_regexp_submission_header_cleanup_enabled Enable regular expression cleanup of submission headers. This is useful for removing or modifying headers in emails submitted by clients.
 postfix_regexp_submission_header_cleanup_enabled: false
 postfix_regexp_submission_header_cleanup_table: "regexp:/etc/postfix/submission_header_cleanup"
 postfix_regexp_submission_header_cleanup_table_entries: []
 # - pattern: "/^Received:/"
 # - pattern: "/^User-Agent:/"
 # - pattern: "/^X-Mailer:/"
 # - pattern: "/^X-Originating-IP:/"
 # - pattern: "/^X-Spam-Flag:/"
 # - pattern: "/^X-Spam-Level:/"
 # - pattern: "/^X-Spam-Status:/"
 ## @section Postfix services
 ## @param postfix_services [array] List of Postfix services to configure. The services are defined in the master.cf file. Each service is a dictionary with the following keys:
 ## - name: The name of the service (e.g., smtp, smtpd, dnsblog, tlsproxy, submission, smtps, etc.)
 ## - type: The type of the service (e.g., inet, unix, fifo, etc.)
 ## - private: Whether the service is private (true or false). If the attribute is undefined, the build-in default is used.
 ## - unprivileged: Whether the service runs as an unprivileged user (true or false). If the attribute is undefined, the build-in default is used.
 ## - chroot: Whether the service runs in a chroot environment (true or false). If the attribute is undefined, the build-in default is used.
 ## - wakeup: Whether the service wakes up on demand (true or false). If the attribute is undefined, the build-in default is used.
 ## - maxproc: The maximum number of processes for the service (integer). If the attribute is undefined, the build-in default is used.
 ## - command: The command to run for the service (e.g., smtpd, pickup, qmgr, etc.)
 ## - args: A list of arguments to pass to the command (e.g., -o, -c, etc.)
 postfix_services:
 - name: "smtp"
  type: "inet"
  private: false
  # unprivileged: true
  # chroot: false
  # wakeup: false
  # maxproc: 100
  command: "smtpd"
  args: []
 - name: "pickup"
  type: "unix"
  private: false
  # unprivileged: true
  # chroot: false
  wakeup: "60"
  maxproc: "1"
  command: "pickup"
  args: []
 - name: "cleanup"
  type: "unix"
  private: false
  # unprivileged: true
  # chroot: false
  # wakeup: ""
  maxproc: "0"
  command: "cleanup"
  args: []
 - name: "qmgr"
  type: "unix"
  private: false
  # unprivileged: true
  # chroot: false
  wakeup: "300"
  maxproc: "1"
  command: "qmgr"
  args: []
 - name: "tlsmgr"
  type: "unix"
  # private: false
  # unprivileged: true
  chroot: false
  wakeup: "1000?"
  maxproc: "1"
  command: "tlsmgr"
  args: []
 - name: "rewrite"
  type: "unix"
  # private: false
  # unprivileged: true
  chroot: false
  # wakeup: ""
  # maxproc: "0"
  command: "trivial-rewrite"
  args: []
 - name: "bounce"
  type: "unix"
  # private: false
  # unprivileged: true
  chroot: false
  # wakeup: ""
  maxproc: "0"
  command: "bounce"
  args: []
 - name: "defer"
  type: "unix"
  # private: false
  # unprivileged: true
  chroot: false
  # wakeup: ""
  maxproc: "0"
  command: "bounce"
  args: []
 - name: "trace"
  type: "unix"
  # private: false
  # unprivileged: true
  chroot: false
  # wakeup: ""
  maxproc: "0"
  command: "bounce"
  args: []
 - name: "verify"
  type: "unix"
  # private: false
  # unprivileged: true
  chroot: false
  # wakeup: ""
  maxproc: "1"
  command: "verify"
  args: []
 - name: "flush"
  type: "unix"
  private: false
  # unprivileged: true
  chroot: false
  wakeup: "1000?"
  maxproc: "0"
  command: "flush"
  args: []
 - name: "proxymap"
  type: "unix"
  # private: false
  # unprivileged: true
  chroot: false
  # wakeup: ""
  # maxproc: 100
  command: "proxymap"
  args: []
 - name: "proxywrite"
  type: "unix"
  # private: false
  # unprivileged: true
  chroot: false
  # wakeup: ""
  maxproc: "1"
  command: "proxymap"
  args: []
 - name: "smtp"
  type: "unix"
  # private: false
  # unprivileged: true
  chroot: false
  # wakeup: ""
  # maxproc: 100
  command: "smtp"
  args: []
 - name: "relay"
  type: "unix"
  # private: false
  # unprivileged: true
  chroot: false
  # wakeup: ""
  # maxproc: 100
  command: "smtp"
  args:
  - "-o syslog_name=postfix/$service_name"
  # - "-o smtp_helo_timeout=5"
  # - "-o smtp_connect_timeout=5"
 - name: "showq"
  type: "unix"
  private: false
  # unprivileged: true
  chroot: false
  # wakeup: ""
  # maxproc: 100
  command: "showq"
  args: []
 - name: "error"
  type: "unix"
  # private: false
  # unprivileged: true
  chroot: false
  # wakeup: ""
  # maxproc: 100
  command: "error"
  args: []
 - name: "retry"
  type: "unix"
  # private: false
  # unprivileged: true
  chroot: false
  # wakeup: ""
  # maxproc: 100
  command: "error"
  args: []
 - name: "discard"
  type: "unix"
  # private: false
  # unprivileged: true
  chroot: false
  # wakeup: ""
  # maxproc: 100
  command: "discard"
  args: []
 - name: "local"
  type: "unix"
  # private: false
  unprivileged: false
  chroot: false
  # wakeup: ""
  # maxproc: 100
  command: "local"
  args: []
 - name: "virtual"
  type: "unix"
  # private: false
  unprivileged: false
  chroot: false
  # wakeup: ""
  # maxproc: 100
  command: "virtual"
  args: []
 - name: "lmtp"
  type: "unix"
  # private: false
  # unprivileged: true
  chroot: false
  # wakeup: ""
  # maxproc: 100
  command: "lmtp"
  args: []
 - name: "anvil"
  type: "unix"
  # private: false
  # unprivileged: true
  chroot: false
  # wakeup: ""
  maxproc: "1"
  command: "anvil"
  args: []
 - name: "scache"
  type: "unix"
  # private: false
  # unprivileged: true
  chroot: false
  # wakeup: ""
  maxproc: "1"
  command: "scache"
  args: []
 - name: "postlog"
  type: "unix-dgram"
  private: false
  # unprivileged: true
  chroot: false
  # wakeup: ""
  maxproc: "1"
  command: "postlogd"
  args: []
@@ -0,0 +1,22 @@
 ---
 - name: Systemd reload
  ansible.builtin.systemd:
    daemon_reload: true
 - name: Postmap sasl_password_maps
  ansible.builtin.command:
    cmd: postmap /etc/postfix/sasl_password_maps
  register: _postfix_postmap_sasl_cmd
  changed_when: false
  failed_when: _postfix_postmap_sasl_cmd.rc > 0
 - name: Restart postfix
  ansible.builtin.systemd:
    name: postfix
    state: restarted
 - name: Reload postfix
  ansible.builtin.systemd:
    name: postfix.service
    state: reloaded
@@ -0,0 +1,797 @@
 ---
 argument_specs:
  main:
    short_description: Postfix mail server
    description:
    - Install and configure a Postfix mail server with PostgreSQL virtual
      mailbox support, TLS, SASL authentication, relay capabilities, and
      access control.
    options:
      postfix_canonical_maps:
        type: list
        elements: str
        default: []
        description: Address rewriting for both sender and recipient. Assembled from enabled LMDB sources.
      postfix_lmdb_canonical_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB canonical maps lookup table.
      postfix_lmdb_canonical_maps_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/canonical_maps"
        description: LMDB lookup table URI for canonical maps.
      postfix_lmdb_canonical_maps_table_entries:
        type: list
        elements: dict
        default: []
        description: Address rewriting entries for both sender and recipient (LMDB lookup table).
        options:
          origin:
            type: str
            required: true
            description: Original address or domain pattern.
          replacement:
            type: str
            required: true
            description: Replacement address or domain.
      postfix_check_client_access_maps:
        type: list
        elements: str
        default: []
        description: Client access control tables. Assembled from enabled LMDB sources.
      postfix_lmdb_check_client_access_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB check_client_access lookup table.
      postfix_lmdb_check_client_access_maps_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/check_client_access_maps"
        description: LMDB lookup table URI for client access control.
      postfix_lmdb_check_client_access_maps_table_entries:
        type: list
        elements: dict
        default: []
        description: Access control entries by client hostname or IP (LMDB lookup table).
        options:
          pattern:
            type: str
            required: true
            description: Hostname, domain, IP address or CIDR range.
          action:
            type: str
            required: true
            description: Action to take (OK, REJECT, DUNNO, INFO).
          reason:
            type: str
            required: false
            description: Custom message (used with REJECT or INFO).
      postfix_check_helo_access_maps:
        type: list
        elements: str
        default: []
        description: HELO/EHLO access control tables. Assembled from enabled LMDB sources.
      postfix_lmdb_check_helo_access_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB check_helo_access lookup table.
      postfix_lmdb_check_helo_access_maps_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/check_helo_access_maps"
        description: LMDB lookup table URI for HELO/EHLO access control.
      postfix_lmdb_check_helo_access_maps_table_entries:
        type: list
        elements: dict
        default: []
        description: Access control entries by HELO/EHLO hostname (LMDB lookup table).
        options:
          pattern:
            type: str
            required: true
            description: Hostname, domain, IP address or CIDR range.
          action:
            type: str
            required: true
            description: Action to take (OK, REJECT, DUNNO, INFO).
          reason:
            type: str
            required: false
            description: Custom message (used with REJECT or INFO).
      postfix_check_recipient_access_maps:
        type: list
        elements: str
        default: []
        description: Recipient access control tables. Assembled from enabled LMDB sources.
      postfix_lmdb_check_recipient_access_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB check_recipient_access lookup table.
      postfix_lmdb_check_recipient_access_maps_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/check_recipient_access_maps"
        description: LMDB lookup table URI for recipient access control.
      postfix_lmdb_check_recipient_access_maps_table_entries:
        type: list
        elements: dict
        default: []
        description: Access control entries by recipient address (LMDB lookup table).
        options:
          pattern:
            type: str
            required: true
            description: Email address, localpart@ or domain.
          action:
            type: str
            required: true
            description: Action to take (OK, REJECT, DUNNO, INFO).
          reason:
            type: str
            required: false
            description: Custom message (used with REJECT or INFO).
      postfix_check_sender_access_maps:
        type: list
        elements: str
        default: []
        description: Sender access control tables. Assembled from enabled LMDB sources.
      postfix_lmdb_check_sender_access_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB check_sender_access lookup table.
      postfix_lmdb_check_sender_access_maps_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/check_sender_access_maps"
        description: LMDB lookup table URI for sender access control.
      postfix_lmdb_check_sender_access_maps_table_entries:
        type: list
        elements: dict
        default: []
        description: Access control entries by sender address (LMDB lookup table).
        options:
          pattern:
            type: str
            required: true
            description: Email address, localpart@ or domain.
          action:
            type: str
            required: true
            description: Action to take (OK, REJECT, DUNNO, INFO).
          reason:
            type: str
            required: false
            description: Custom message (used with REJECT or INFO).
      postfix_lmdb_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB lookup tables for virtual maps.
      postfix_lmdb_relay_domains_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB relay domain lookup table.
      postfix_lmdb_relay_domains_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/relay_domain_maps"
        description: LMDB lookup table URI for relay domains.
      postfix_lmdb_relay_domains_table_entries:
        type: list
        elements: dict
        default: []
        description: Domains for which this server acts as relay (LMDB lookup table).
        options:
          domain:
            type: str
            required: true
            description: Domain or subdomain pattern to match.
          action:
            type: str
            required: true
            description: Action to take (OK, REJECT, DUNNO, etc.).
          reason:
            type: str
            required: false
            description: Custom rejection message (only used with REJECT).
      postfix_lmdb_relay_recipients_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB relay recipient lookup table.
      postfix_lmdb_relay_recipients_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/relay_recipient_maps"
        description: LMDB lookup table URI for relay recipients.
      postfix_lmdb_relay_recipients_table_entries:
        type: list
        elements: dict
        default: []
        description: Valid recipients in relay domains (LMDB lookup table).
        options:
          recipient:
            type: str
            required: true
            description: Recipient address or @domain wildcard.
          action:
            type: str
            required: true
            description: Action to take (OK, REJECT, DUNNO, etc.).
          reason:
            type: str
            required: false
            description: Custom rejection message (only used with REJECT).
      postfix_lmdb_smtpd_sender_login_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB sender login lookup table.
      postfix_lmdb_smtpd_sender_login_maps_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/smtpd_sender_login_maps"
        description: LMDB lookup table URI for sender login maps.
      postfix_lmdb_smtpd_sender_login_maps_table_entries:
        type: list
        elements: dict
        default: []
        description: SASL login names that own sender addresses (LMDB lookup table).
        options:
          address:
            type: str
            required: true
            description: Sender address (user@domain, user, or @domain).
          login:
            type: str
            required: true
            description: SASL login name that owns the address.
      postfix_lmdb_virtual_alias_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB virtual alias lookup table.
      postfix_lmdb_virtual_alias_maps_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/virtual_alias_maps"
        description: LMDB lookup table URI for virtual alias maps.
      postfix_lmdb_virtual_alias_maps_table_entries:
        type: list
        elements: dict
        default: []
        description: Virtual alias address mappings (LMDB lookup table).
        options:
          source:
            type: str
            required: true
            description: Source address or @domain pattern.
          destination:
            type: str
            required: true
            description: Destination address to forward to.
      postfix_lmdb_virtual_mailbox_domains_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB virtual mailbox domain lookup table.
      postfix_lmdb_virtual_mailbox_domains_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/virtual_mailbox_domains"
        description: LMDB lookup table URI for virtual mailbox domains.
      postfix_lmdb_virtual_mailbox_domains_table_entries:
        type: list
        elements: dict
        default: []
        description: Virtual mailbox domain entries (LMDB lookup table).
        options:
          domain:
            type: str
            required: true
            description: Domain name.
          action:
            type: str
            required: true
            description: Action (typically OK).
      postfix_lmdb_smtp_sasl_password_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB SMTP SASL password maps lookup table.
      postfix_lmdb_smtp_sasl_password_maps_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/sasl_password_maps"
        description: LMDB lookup table URI for SMTP SASL password maps.
      postfix_lmdb_smtp_sasl_password_maps_table_entries:
        type: list
        elements: dict
        default: []
        description: SASL credentials for relay host authentication (LMDB lookup table).
        options:
          destination:
            type: str
            required: true
            description: Relay host or domain to authenticate against.
          username:
            type: str
            required: true
            description: SASL username.
          password:
            type: str
            required: true
            description: SASL password.
      postfix_lmdb_sender_canonical_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB sender canonical maps lookup table.
      postfix_lmdb_sender_canonical_maps_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/sender_canonical_maps"
        description: LMDB lookup table URI for sender canonical maps.
      postfix_lmdb_sender_canonical_maps_table_entries:
        type: list
        elements: dict
        default: []
        description: Sender address rewriting entries (LMDB lookup table).
        options:
          origin:
            type: str
            required: true
            description: Original sender address or domain.
          replacement:
            type: str
            required: true
            description: Replacement sender address or domain.
      postfix_lmdb_tls_policy_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB TLS policy maps lookup table.
      postfix_lmdb_tls_policy_maps_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/tls_policy_maps"
        description: LMDB lookup table URI for TLS policy maps.
      postfix_lmdb_tls_policy_maps_table_entries:
        type: list
        elements: dict
        default: []
        description: Per-destination TLS security policy (LMDB lookup table).
        options:
          destination:
            type: str
            required: true
            description: Domain, subdomain or [host]:port pattern.
          policy:
            type: str
            required: true
            description: TLS policy level (none, may, encrypt, verify, secure).
      postfix_lmdb_recipient_canonical_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB recipient canonical maps lookup table.
      postfix_lmdb_recipient_canonical_maps_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/recipient_canonical_maps"
        description: LMDB lookup table URI for recipient canonical maps.
      postfix_lmdb_recipient_canonical_maps_table_entries:
        type: list
        elements: dict
        default: []
        description: Recipient address rewriting entries (LMDB lookup table).
        options:
          origin:
            type: str
            required: true
            description: Original recipient address or domain.
          replacement:
            type: str
            required: true
            description: Replacement recipient address or domain.
      postfix_lmdb_relocated_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB relocated maps lookup table.
      postfix_lmdb_relocated_maps_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/relocated_maps"
        description: LMDB lookup table URI for relocated maps.
      postfix_lmdb_relocated_maps_table_entries:
        type: list
        elements: dict
        default: []
        description: Contact information for relocated users (LMDB lookup table).
        options:
          old_address:
            type: str
            required: true
            description: Former address that no longer exists.
          new_address:
            type: str
            required: true
            description: New contact address for the user.
      postfix_lmdb_transport_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB transport maps lookup table.
      postfix_lmdb_transport_maps_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/transport_maps"
        description: LMDB lookup table URI for transport maps.
      postfix_lmdb_transport_maps_table_entries:
        type: list
        elements: dict
        default: []
        description: Custom transport routing rules (LMDB lookup table).
        options:
          pattern:
            type: str
            required: true
            description: Domain or address pattern to match.
          transport:
            type: str
            required: true
            description: Transport and next-hop destination.
      postfix_lmdb_virtual_mailbox_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB virtual mailbox maps lookup table.
      postfix_lmdb_virtual_mailbox_maps_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/virtual_mailbox_maps"
        description: LMDB lookup table URI for virtual mailbox maps.
      postfix_lmdb_virtual_mailbox_maps_table_entries:
        type: list
        elements: dict
        default: []
        description: Valid virtual mailbox addresses (LMDB lookup table).
        options:
          address:
            type: str
            required: true
            description: Email address or @domain pattern.
          action:
            type: str
            required: true
            description: Action (typically OK).
      postfix_pgsql_enabled:
        type: bool
        required: false
        default: false
        description: Enable PostgreSQL lookup tables for virtual maps.
      postfix_pgsql_username:
        type: str
        required: false
        default: "my-username"
        description: PostgreSQL database user for Postfix lookups.
      postfix_pgsql_password:
        type: str
        required: false
        default: "my-password"
        description: PostgreSQL database password for Postfix lookups.
      postfix_pgsql_host:
        type: str
        required: false
        default: "localhost"
        description: PostgreSQL database host.
      postfix_pgsql_port:
        type: int
        required: false
        default: 5432
        description: PostgreSQL database port.
      postfix_pgsql_name:
        type: str
        required: false
        default: "postfix"
        description: PostgreSQL database name.
      postfix_pgsql_relay_domains_enabled:
        type: bool
        required: false
        default: false
        description: Enable PostgreSQL relay domain lookup.
      postfix_pgsql_relay_domains_table:
        type: str
        required: false
        default: "proxy:pgsql:/etc/postfix/pgsql_relay_domain_maps.cf"
        description: PostgreSQL lookup table URI for relay domains.
      postfix_pgsql_relay_domains_query:
        type: str
        required: false
        default: "SELECT 'OK' FROM domain d WHERE d.domain='%d' AND d.active='1' AND d.backupmx='1' AND d.transport='relay'"
        description: SQL query to check if a domain is a relay domain.
      postfix_pgsql_relay_recipient_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable PostgreSQL relay recipient lookup.
      postfix_pgsql_relay_recipient_maps_table:
        type: str
        required: false
        default: "proxy:pgsql:/etc/postfix/pgsql_relay_recipient_maps.cf"
        description: PostgreSQL lookup table URI for relay recipients.
      postfix_pgsql_relay_recipient_maps_query:
        type: str
        required: false
        default: "SELECT 'OK' FROM domain d INNER JOIN mailbox m ON (d.domain = m.domain) WHERE m.local_part='%u' AND m.domain='%d' AND m.active = '1' AND d.active='1' AND d.transport='relay'"
        description: SQL query to check if a recipient is valid in a relay domain.
      postfix_pgsql_smtpd_sender_login_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable PostgreSQL sender login lookup.
      postfix_pgsql_smtpd_sender_login_maps_table:
        type: str
        required: false
        default: "proxy:pgsql:/etc/postfix/pgsql_sender_login_maps.cf"
        description: PostgreSQL lookup table URI for sender login maps.
      postfix_pgsql_smtpd_sender_login_maps_query:
        type: str
        required: false
        default: "SELECT username FROM mailbox WHERE username='%s' AND active='1'"
        description: SQL query to map sender addresses to login names.
      postfix_pgsql_virtual_alias_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable PostgreSQL virtual alias lookup.
      postfix_pgsql_virtual_alias_maps_table:
        type: str
        required: false
        default: "proxy:pgsql:/etc/postfix/pgsql_virtual_alias_maps.cf"
        description: PostgreSQL lookup table URI for virtual alias maps.
      postfix_pgsql_virtual_alias_maps_query:
        type: str
        required: false
        default: "SELECT goto FROM alias a WHERE a.address='%s' AND a.active = '1'"
        description: SQL query for virtual alias resolution.
      postfix_pgsql_virtual_alias_domain_catchall_maps_query:
        type: str
        required: false
        default: "SELECT goto FROM alias a, alias_domain ad WHERE ad.alias_domain = '%d' and a.address = CONCAT('@', ad.target_domain) AND a.active = '1' AND ad.active='1'"
        description: SQL query for alias domain catchall resolution.
      postfix_pgsql_virtual_alias_domain_mailbox_maps_query:
        type: str
        required: false
        default: "SELECT 'OK' FROM mailbox m, alias_domain ad WHERE ad.alias_domain = '%d' and m.username = CONCAT('%u', '@', ad.target_domain) AND m.active = '1' AND ad.active='1'"
        description: SQL query for alias domain mailbox validation.
      postfix_pgsql_virtual_alias_domain_maps_query:
        type: str
        required: false
        default: "SELECT goto FROM alias a, alias_domain ad WHERE ad.alias_domain = '%d' and a.address = CONCAT('%u', '@', ad.target_domain) AND a.active = '1' AND ad.active='1'"
        description: SQL query for alias domain address resolution.
      postfix_pgsql_virtual_mailbox_domains_enabled:
        type: bool
        required: false
        default: false
        description: Enable PostgreSQL virtual mailbox domain lookup.
      postfix_pgsql_virtual_mailbox_domains_table:
        type: str
        required: false
        default: "proxy:pgsql:/etc/postfix/pgsql_virtual_mailbox_domains.cf"
        description: PostgreSQL lookup table URI for virtual mailbox domains.
      postfix_pgsql_virtual_mailbox_domains_query:
        type: str
        required: false
        default: "SELECT d.domain FROM domain d WHERE d.domain='%s' AND d.backupmx = '0' AND d.active = '1'"
        description: SQL query for virtual mailbox domain validation.
      postfix_pgsql_virtual_mailbox_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable PostgreSQL virtual mailbox maps lookup.
      postfix_pgsql_virtual_mailbox_maps_table:
        type: str
        required: false
        default: "proxy:pgsql:/etc/postfix/pgsql_virtual_mailbox_maps.cf"
        description: PostgreSQL lookup table URI for virtual mailbox maps.
      postfix_pgsql_virtual_mailbox_maps_query:
        type: str
        required: false
        default: "SELECT 'OK' FROM mailbox m WHERE m.username='%s' AND active = '1'"
        description: SQL query for virtual mailbox validation.
      postfix_pgsql_virtual_mailbox_limit_maps_query:
        type: str
        required: false
        default: "SELECT quota FROM mailbox WHERE username='%s' AND active = '1'"
        description: SQL query for mailbox quota lookup.
      postfix_mail_domain:
        type: str
        required: false
        description: FQDN of the mail server, used as certificate name and myhostname.
      postfix_mynetworks:
        type: list
        elements: str
        default: []
        description: Additional IP addresses or CIDR ranges to trust for relaying.
      postfix_proxy_interfaces:
        type: str
        default: ""
        description: Public IP address when Postfix runs behind a proxy or NAT.
      postfix_recipient_canonical_maps:
        type: list
        elements: str
        default: []
        description: Recipient address rewriting. Assembled from enabled LMDB sources.
      postfix_relay_domains:
        type: list
        elements: str
        default: []
        description: Domains for which this server acts as relay. Assembled from enabled LMDB/PgSQL sources.
      postfix_relay_recipient_maps:
        type: list
        elements: str
        default: []
        description: Valid recipients in relay domains. Assembled from enabled LMDB/PgSQL sources.
      postfix_smtpd_sender_login_maps:
        type: list
        elements: str
        default: []
        description: SASL login names that own sender addresses. Assembled from enabled LMDB/PgSQL sources.
      postfix_relayhost:
        type: str
        required: false
        description: Next-hop destination for non-local mail (e.g. "[smtp.example.com]:587").
      postfix_relocated_maps:
        type: list
        elements: str
        default: []
        description: Contact information for relocated users. Assembled from enabled LMDB sources.
      postfix_smtp_sasl_password_maps:
        type: list
        elements: str
        default: []
        description: SMTP SASL password maps. Assembled from enabled LMDB sources.
      postfix_sender_canonical_maps:
        type: list
        elements: str
        default: []
        description: Sender address rewriting. Assembled from enabled LMDB sources.
      postfix_smtp_sasl_auth_enable:
        type: bool
        default: false
        description: Enable SASL authentication for the Postfix SMTP client.
      postfix_tls_policy_maps:
        type: list
        elements: str
        default: []
        description: Per-destination TLS security policy. Assembled from enabled LMDB sources.
      postfix_transport_maps:
        type: list
        elements: str
        default: []
        description: Custom transport routing rules. Assembled from enabled LMDB sources.
      postfix_virtual_alias_maps:
        type: list
        elements: str
        default: []
        description: Virtual alias address mappings. Assembled from enabled LMDB/PgSQL sources.
      postfix_virtual_mailbox_domains:
        type: list
        elements: str
        default: []
        description: Virtual mailbox domains. Assembled from enabled LMDB/PgSQL sources.
      postfix_virtual_mailbox_maps:
        type: list
        elements: str
        default: []
        description: Valid virtual mailbox addresses. Assembled from enabled LMDB/PgSQL sources.
@@ -0,0 +1,17 @@
 dependencies: []
 galaxy_info:
  author: "Markus Pesch"
  company: "Cryptic Systems"
  description: "Role to install and maintain a Postfix mail server"
  galaxy_tags:
  - mta
  - postfix
  - email
  license: "MIT"
  min_ansible_version: "2.9"
  namespace: volker-raschek
  platforms:
  - name: ArchLinux
    versions:
    - all
  role_name: "postfix"
@@ -0,0 +1,19 @@
 {
  "name": "postfix-ansible-role",
  "homepage": "https://git.cryptic.systems/volker.raschek/postfix-ansible-role.git",
  "license": "MIT",
  "private": true,
  "engineStrict": true,
  "engines": {
    "node": ">=16.0.0",
    "npm": ">=8.0.0"
  },
  "scripts": {
    "readme:lint": "markdownlint *.md -f",
    "readme:parameters": "readme-generator -v defaults/main.yaml -r README.md"
  },
  "devDependencies": {
    "@bitnami/readme-generator-for-helm": "^2.5.0",
    "markdownlint-cli": "^0.47.0"
  }
 }
@@ -0,0 +1,9 @@
 {
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "local>volker.raschek/renovate-config:default#master",
    "local>volker.raschek/renovate-config:container#master",
    "local>volker.raschek/renovate-config:actions#master",
    "local>volker.raschek/renovate-config:regexp#master"
  ]
 }
@@ -0,0 +1,303 @@
 ---
 - name: Install postfix and third party applications
  ansible.builtin.package:
    name: "{{ item }}"
    state: "present"
  with_items:
  - postfix
  - postfix-lmdb
  - postfix-mysql
  - postfix-pcre
  - postfix-pgsql
  - s-nail # provides mailx
 - name: Create postfix configuration directory
  ansible.builtin.file:
    name: "/etc/postfix"
    owner: "root"
    group: "root"
    mode: "0755"
    state: "directory"
 - name: Prepare mynetworks
  block:
  - name: Set postfix_mynetworks
    ansible.builtin.set_fact:
      postfix_mynetworks: []
    when: postfix_mynetworks is not defined
  - name: Append missing local network to postfix_mynetworks
    ansible.builtin.set_fact:
      postfix_mynetworks: "{{ postfix_mynetworks + [item] }}"
    when: item not in postfix_mynetworks
    with_items:
    - "127.0.0.0/8"
    - "[::ffff:127.0.0.0]/104"
    - "[::1]/128"
 - name: Install template configs
  ansible.builtin.template:
    src: "etc/postfix/{{ item }}.j2"
    dest: "/etc/postfix/{{ item }}"
    owner: "root"
    group: postfix
    mode: "0640"
  with_items:
  - main.cf
  - master.cf
  notify:
  - Restart postfix
 - name: Create alias files
  when: postfix_alias_database_enabled and item.enabled
  ansible.builtin.template:
    src: "etc/postfix/{{ item.src }}"
    dest: "{{ item.dest | regex_replace('^.*:/', '/') }}"
    owner: "root"
    group: postfix
    mode: "0640"
  with_items:
  - { src: "aliases.j2", dest: "{{ postfix_alias_database_table }}", enabled: "{{ postfix_alias_database_enabled }}" }
 - name: Create alias db via postalias
  when: postfix_alias_database_enabled and item.enabled
  ansible.builtin.command:
    cmd: postalias "{{ item.dest | regex_replace('^.*:/', '/') }}"
  changed_when: false
  with_items:
  - { src: "aliases.j2", dest: "{{ postfix_alias_database_table }}", enabled: "{{ postfix_alias_database_enabled }}" }
 - name: Remove alias files
  when: not postfix_alias_database_enabled or (postfix_alias_database_enabled and not item.enabled)
  ansible.builtin.file:
    path: "{{ item.dest | regex_replace('^.*:/', '/') }}"
    state: "absent"
  with_items:
  - { src: "aliases.j2", dest: "{{ postfix_alias_database_table }}", enabled: "{{ postfix_alias_database_enabled }}" }
 - name: Remove alias db files
  when: not postfix_alias_database_enabled or (postfix_alias_database_enabled and not item.enabled)
  ansible.builtin.file:
    path: "{{ item.dest | regex_replace('^.*:/', '/') }}.db"
    state: "absent"
  with_items:
  - { src: "aliases.j2", dest: "{{ postfix_alias_database_table }}", enabled: "{{ postfix_alias_database_enabled }}" }
 - name: Create lmdb lookup files
  when: postfix_lmdb_enabled and item.enabled
  ansible.builtin.template:
    src: "etc/postfix/{{ item.src }}"
    dest: "{{ item.dest | regex_replace('^.*:/', '/') }}"
    owner: "root"
    group: postfix
    mode: "0640"
  with_items:
  - { src: "canonical_maps.j2", dest: "{{ postfix_lmdb_canonical_maps_table }}", enabled: "{{ postfix_lmdb_canonical_maps_enabled }}" }
  - { src: "check_client_access_maps.j2", dest: "{{ postfix_lmdb_check_client_access_maps_table }}", enabled: "{{ postfix_lmdb_check_client_access_maps_enabled }}" }
  - { src: "check_helo_access_maps.j2", dest: "{{ postfix_lmdb_check_helo_access_maps_table }}", enabled: "{{ postfix_lmdb_check_helo_access_maps_enabled }}" }
  - { src: "check_recipient_access_maps.j2", dest: "{{ postfix_lmdb_check_recipient_access_maps_table }}", enabled: "{{ postfix_lmdb_check_recipient_access_maps_enabled }}" }
  - { src: "check_sender_access_maps.j2", dest: "{{ postfix_lmdb_check_sender_access_maps_table }}", enabled: "{{ postfix_lmdb_check_sender_access_maps_enabled }}" }
  - { src: "recipient_canonical_maps.j2", dest: "{{ postfix_lmdb_recipient_canonical_maps_table }}", enabled: "{{ postfix_lmdb_recipient_canonical_maps_enabled }}" }
  - { src: "relay_domain_maps.j2", dest: "{{ postfix_lmdb_relay_domains_table }}", enabled: "{{ postfix_lmdb_relay_domains_enabled }}" }
  - { src: "relay_recipient_maps.j2", dest: "{{ postfix_lmdb_relay_recipients_table }}", enabled: "{{ postfix_lmdb_relay_recipients_enabled }}" }
  - { src: "relocated_maps.j2", dest: "{{ postfix_lmdb_relocated_maps_table }}", enabled: "{{ postfix_lmdb_relocated_maps_enabled }}" }
  - { src: "sender_canonical_maps.j2", dest: "{{ postfix_lmdb_sender_canonical_maps_table }}", enabled: "{{ postfix_lmdb_sender_canonical_maps_enabled }}" }
  - { src: "smtpd_sender_login_maps.j2", dest: "{{ postfix_lmdb_smtpd_sender_login_maps_table }}", enabled: "{{ postfix_lmdb_smtpd_sender_login_maps_enabled }}" }
  - { src: "tls_policy_maps.j2", dest: "{{ postfix_lmdb_tls_policy_maps_table }}", enabled: "{{ postfix_lmdb_tls_policy_maps_enabled }}" }
  - { src: "transport_maps.j2", dest: "{{ postfix_lmdb_transport_maps_table }}", enabled: "{{ postfix_lmdb_transport_maps_enabled }}" }
  - { src: "virtual_alias_maps.j2", dest: "{{ postfix_lmdb_virtual_alias_maps_table }}", enabled: "{{ postfix_lmdb_virtual_alias_maps_enabled }}" }
  - { src: "virtual_mailbox_domains.j2", dest: "{{ postfix_lmdb_virtual_mailbox_domains_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_domains_enabled }}" }
  - { src: "virtual_mailbox_maps.j2", dest: "{{ postfix_lmdb_virtual_mailbox_maps_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_maps_enabled }}" }
  notify:
  - Restart postfix
 - name: Create lmdb lookup tables via postmap
  when: postfix_lmdb_enabled and item.enabled
  ansible.builtin.command:
    cmd: postmap "{{ item.dest | regex_replace('^.*:/', '/') }}"
    creates: "{{ item.dest | regex_replace('^.*:/', '/') }}.lmdb"
  with_items:
  - { src: "canonical_maps.j2", dest: "{{ postfix_lmdb_canonical_maps_table }}", enabled: "{{ postfix_lmdb_canonical_maps_enabled }}" }
  - { src: "check_client_access_maps.j2", dest: "{{ postfix_lmdb_check_client_access_maps_table }}", enabled: "{{ postfix_lmdb_check_client_access_maps_enabled }}" }
  - { src: "check_helo_access_maps.j2", dest: "{{ postfix_lmdb_check_helo_access_maps_table }}", enabled: "{{ postfix_lmdb_check_helo_access_maps_enabled }}" }
  - { src: "check_recipient_access_maps.j2", dest: "{{ postfix_lmdb_check_recipient_access_maps_table }}", enabled: "{{ postfix_lmdb_check_recipient_access_maps_enabled }}" }
  - { src: "check_sender_access_maps.j2", dest: "{{ postfix_lmdb_check_sender_access_maps_table }}", enabled: "{{ postfix_lmdb_check_sender_access_maps_enabled }}" }
  - { src: "recipient_canonical_maps.j2", dest: "{{ postfix_lmdb_recipient_canonical_maps_table }}", enabled: "{{ postfix_lmdb_recipient_canonical_maps_enabled }}" }
  - { src: "relay_domain_maps.j2", dest: "{{ postfix_lmdb_relay_domains_table }}", enabled: "{{ postfix_lmdb_relay_domains_enabled }}" }
  - { src: "relay_recipient_maps.j2", dest: "{{ postfix_lmdb_relay_recipients_table }}", enabled: "{{ postfix_lmdb_relay_recipients_enabled }}" }
  - { src: "relocated_maps.j2", dest: "{{ postfix_lmdb_relocated_maps_table }}", enabled: "{{ postfix_lmdb_relocated_maps_enabled }}" }
  - { src: "sender_canonical_maps.j2", dest: "{{ postfix_lmdb_sender_canonical_maps_table }}", enabled: "{{ postfix_lmdb_sender_canonical_maps_enabled }}" }
  - { src: "smtpd_sender_login_maps.j2", dest: "{{ postfix_lmdb_smtpd_sender_login_maps_table }}", enabled: "{{ postfix_lmdb_smtpd_sender_login_maps_enabled }}" }
  - { src: "tls_policy_maps.j2", dest: "{{ postfix_lmdb_tls_policy_maps_table }}", enabled: "{{ postfix_lmdb_tls_policy_maps_enabled }}" }
  - { src: "transport_maps.j2", dest: "{{ postfix_lmdb_transport_maps_table }}", enabled: "{{ postfix_lmdb_transport_maps_enabled }}" }
  - { src: "virtual_alias_maps.j2", dest: "{{ postfix_lmdb_virtual_alias_maps_table }}", enabled: "{{ postfix_lmdb_virtual_alias_maps_enabled }}" }
  - { src: "virtual_mailbox_domains.j2", dest: "{{ postfix_lmdb_virtual_mailbox_domains_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_domains_enabled }}" }
  - { src: "virtual_mailbox_maps.j2", dest: "{{ postfix_lmdb_virtual_mailbox_maps_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_maps_enabled }}" }
 - name: Remove lmdb lookup tables
  when: not postfix_lmdb_enabled or (postfix_lmdb_enabled and not item.enabled)
  ansible.builtin.file:
    path: "{{ item.path | regex_replace('^.*:/', '/') }}"
    state: "absent"
  with_items:
  - { path: "{{ postfix_lmdb_canonical_maps_table }}", enabled: "{{ postfix_lmdb_canonical_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_check_client_access_maps_table }}", enabled: "{{ postfix_lmdb_check_client_access_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_check_helo_access_maps_table }}", enabled: "{{ postfix_lmdb_check_helo_access_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_check_recipient_access_maps_table }}", enabled: "{{ postfix_lmdb_check_recipient_access_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_check_sender_access_maps_table }}", enabled: "{{ postfix_lmdb_check_sender_access_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_recipient_canonical_maps_table }}", enabled: "{{ postfix_lmdb_recipient_canonical_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_relay_domains_table }}", enabled: "{{ postfix_lmdb_relay_domains_enabled }}" }
  - { path: "{{ postfix_lmdb_relay_recipients_table }}", enabled: "{{ postfix_lmdb_relay_recipients_enabled }}" }
  - { path: "{{ postfix_lmdb_relocated_maps_table }}", enabled: "{{ postfix_lmdb_relocated_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_sender_canonical_maps_table }}", enabled: "{{ postfix_lmdb_sender_canonical_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_smtpd_sender_login_maps_table }}", enabled: "{{ postfix_lmdb_smtpd_sender_login_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_tls_policy_maps_table }}", enabled: "{{ postfix_lmdb_tls_policy_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_transport_maps_table }}", enabled: "{{ postfix_lmdb_transport_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_virtual_alias_maps_table }}", enabled: "{{ postfix_lmdb_virtual_alias_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_virtual_mailbox_domains_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_domains_enabled }}" }
  - { path: "{{ postfix_lmdb_virtual_mailbox_maps_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_maps_enabled }}" }
  notify:
  - Restart postfix
 - name: Remove lmdb lookup tables
  when: not postfix_lmdb_enabled or (postfix_lmdb_enabled and not item.enabled)
  ansible.builtin.file:
    path: "{{ item.path | regex_replace('^.*:/', '/') }}.lmdb"
    state: "absent"
  with_items:
  - { path: "{{ postfix_lmdb_canonical_maps_table }}", enabled: "{{ postfix_lmdb_canonical_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_check_client_access_maps_table }}", enabled: "{{ postfix_lmdb_check_client_access_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_check_helo_access_maps_table }}", enabled: "{{ postfix_lmdb_check_helo_access_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_check_recipient_access_maps_table }}", enabled: "{{ postfix_lmdb_check_recipient_access_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_check_sender_access_maps_table }}", enabled: "{{ postfix_lmdb_check_sender_access_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_recipient_canonical_maps_table }}", enabled: "{{ postfix_lmdb_recipient_canonical_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_relay_domains_table }}", enabled: "{{ postfix_lmdb_relay_domains_enabled }}" }
  - { path: "{{ postfix_lmdb_relay_recipients_table }}", enabled: "{{ postfix_lmdb_relay_recipients_enabled }}" }
  - { path: "{{ postfix_lmdb_relocated_maps_table }}", enabled: "{{ postfix_lmdb_relocated_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_sender_canonical_maps_table }}", enabled: "{{ postfix_lmdb_sender_canonical_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_smtpd_sender_login_maps_table }}", enabled: "{{ postfix_lmdb_smtpd_sender_login_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_tls_policy_maps_table }}", enabled: "{{ postfix_lmdb_tls_policy_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_transport_maps_table }}", enabled: "{{ postfix_lmdb_transport_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_virtual_alias_maps_table }}", enabled: "{{ postfix_lmdb_virtual_alias_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_virtual_mailbox_domains_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_domains_enabled }}" }
  - { path: "{{ postfix_lmdb_virtual_mailbox_maps_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_maps_enabled }}" }
  notify:
  - Restart postfix
 - name: Create PostgreSQL lookup files
  when: postfix_pgsql_enabled and item.enabled
  ansible.builtin.template:
    src: "etc/postfix/{{ item.src }}"
    dest: "{{ item.dest | regex_replace('^.*:/', '/') }}"
    owner: "root"
    group: postfix
    mode: "0640"
  with_items:
  - { src: "pgsql_relay_domain_maps.cf.j2", dest: "{{ postfix_pgsql_relay_domains_table }}", enabled: "{{ postfix_pgsql_relay_domains_enabled }}" }
  - { src: "pgsql_relay_recipient_maps.cf.j2", dest: "{{ postfix_pgsql_relay_recipient_maps_table }}", enabled: "{{ postfix_pgsql_relay_recipient_maps_enabled }}" }
  - { src: "pgsql_sender_login_maps.cf.j2", dest: "{{ postfix_pgsql_smtpd_sender_login_maps_table }}", enabled: "{{ postfix_pgsql_smtpd_sender_login_maps_enabled }}" }
  - { src: "pgsql_virtual_alias_domain_catchall_maps.cf.j2", dest: "{{ postfix_pgsql_virtual_alias_domain_catchall_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_domain_catchall_maps_enabled }}" }
  - { src: "pgsql_virtual_alias_domain_mailbox_maps.cf.j2", dest: "{{ postfix_pgsql_virtual_alias_domain_mailbox_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_domain_mailbox_maps_enabled }}" }
  - { src: "pgsql_virtual_alias_domain_maps.cf.j2", dest: "{{ postfix_pgsql_virtual_alias_domain_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_domain_maps_enabled }}" }
  - { src: "pgsql_virtual_alias_maps.cf.j2", dest: "{{ postfix_pgsql_virtual_alias_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_maps_enabled }}" }
  - { src: "pgsql_virtual_mailbox_domains.cf.j2", dest: "{{ postfix_pgsql_virtual_mailbox_domains_table }}", enabled: "{{ postfix_pgsql_virtual_mailbox_domains_enabled }}" }
  - { src: "pgsql_virtual_mailbox_limit_maps.cf.j2", dest: "{{ postfix_pgsql_virtual_mailbox_limit_maps_table }}", enabled: "{{ postfix_pgsql_virtual_mailbox_limit_maps_enabled }}" }
  - { src: "pgsql_virtual_mailbox_maps.cf.j2", dest: "{{ postfix_pgsql_virtual_mailbox_maps_table }}", enabled: "{{ postfix_pgsql_virtual_mailbox_maps_enabled }}" }
  notify:
  - Restart postfix
 - name: Remove PostgreSQL lookup files
  when: not postfix_pgsql_enabled or (postfix_pgsql_enabled and not item.enabled)
  ansible.builtin.file:
    path: "{{ item.path | regex_replace('^.*:/', '/') }}"
    state: "absent"
  with_items:
  - { path: "{{ postfix_pgsql_relay_domains_table }}", enabled: "{{ postfix_pgsql_relay_domains_enabled }}" }
  - { path: "{{ postfix_pgsql_relay_recipient_maps_table }}", enabled: "{{ postfix_pgsql_relay_recipient_maps_enabled }}" }
  - { path: "{{ postfix_pgsql_smtpd_sender_login_maps_table }}", enabled: "{{ postfix_pgsql_smtpd_sender_login_maps_enabled }}" }
  - { path: "{{ postfix_pgsql_virtual_alias_domain_catchall_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_domain_catchall_maps_enabled }}" }
  - { path: "{{ postfix_pgsql_virtual_alias_domain_mailbox_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_domain_mailbox_maps_enabled }}" }
  - { path: "{{ postfix_pgsql_virtual_alias_domain_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_domain_maps_enabled }}" }
  - { path: "{{ postfix_pgsql_virtual_alias_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_maps_enabled }}" }
  - { path: "{{ postfix_pgsql_virtual_mailbox_domains_table }}", enabled: "{{ postfix_pgsql_virtual_mailbox_domains_enabled }}" }
  - { path: "{{ postfix_pgsql_virtual_mailbox_limit_maps_table }}", enabled: "{{ postfix_pgsql_virtual_mailbox_limit_maps_enabled }}" }
  - { path: "{{ postfix_pgsql_virtual_mailbox_maps_table }}", enabled: "{{ postfix_pgsql_virtual_mailbox_maps_enabled }}" }
  notify:
  - Restart postfix
 - name: Create Regexp lookup files
  when: postfix_regexp_enabled and item.enabled
  ansible.builtin.template:
    src: "etc/postfix/{{ item.src }}"
    dest: "{{ item.dest | regex_replace('^.*:/', '/') }}"
    owner: "root"
    group: postfix
    mode: "0640"
  with_items:
  - { src: "submission_header_cleanup.j2", dest: "{{ postfix_regexp_submission_header_cleanup_table }}", enabled: "{{ postfix_regexp_submission_header_cleanup_enabled }}" }
  notify:
  - Restart postfix
 - name: Remove Regexp lookup files
  when: not postfix_regexp_enabled or (postfix_regexp_enabled and not item.enabled)
  ansible.builtin.file:
    path: "{{ item.path | regex_replace('^.*:/', '/') }}"
    state: "absent"
  with_items:
  - { path: "{{ postfix_regexp_submission_header_cleanup_table }}", enabled: "{{ postfix_regexp_submission_header_cleanup_enabled }}" }
  notify:
  - Restart postfix
 - name: Install SASL relay authentication
  when: postfix_smtp_sasl_auth_enable | default(false)
  ansible.builtin.template:
    src: "etc/postfix/sasl_password_maps.j2"
    dest: "/etc/postfix/sasl_password_maps"
    owner: "root"
    group: "root"
    mode: "0600"
  notify:
  - Postmap sasl_password_maps
  - Restart postfix
 - name: Install lets encrypt renewal hook for postfix
  tags: [ letsencrypt-hooks ]
  when: postfix_myhostname is defined and postfix_myhostname | length > 0
  block:
  - name: Create directory for letsencrypt renewal hooks
    ansible.builtin.file:
      path: "/etc/letsencrypt/renewal-hooks/post"
      owner: "root"
      group: "root"
      mode: "0755"
  - name: Create letsencrypt renewal hook for postfix
    ansible.builtin.template:
      src: "etc/letsencrypt/renewal-hooks/post/postfix.sh.j2"
      dest: "/etc/letsencrypt/renewal-hooks/post/postfix.sh"
      owner: "root"
      group: "root"
      mode: "0755"
 - name: Start and enable postfix
  ansible.builtin.systemd:
    name: postfix
    enabled: true
    state: started
 - name: Install systemd-email script
  ansible.builtin.template:
    src: "usr/local/sbin/systemd-email.sh.j2"
    dest: "/usr/local/sbin/systemd-email.sh"
    owner: "root"
    group: "root"
    mode: "0755"
 - name: Install systemd-status
  ansible.builtin.template:
    src: "etc/systemd/system/status-email@.service.j2"
    dest: "/etc/systemd/system/status-email@.service"
    owner: "root"
    group: "root"
    mode: "0644"
  notify:
  - Systemd reload
@@ -0,0 +1,50 @@
 #!/bin/bash
 #
 # {{ ansible_managed }}
 #
 set -e
 LOG_FILE="${0}.log"
 function logInfo() {
  TIMESTAMP=$(date '+%Y-%m-%d_%H:%M:%S' )
  echo "${TIMESTAMP}: INFO: ${1}"
  echo "${TIMESTAMP}: INFO: ${1}" >> "${LOG_FILE}"
 }
 function logFatal() {
  TIMESTAMP=$(date '+%Y-%m-%d_%H:%M:%S' )
  echo "${TIMESTAMP}: FATAL: ${1}"
  echo "${TIMESTAMP}: FATAL: ${1}" >> "${LOG_FILE}"
  exit 1
 }
 POSTFIX_LETSENCRYPT_DOMAIN="{{ postfix_myhostname }}"
 # The shell variable $RENEWED_DOMAINS will contain a space-delimited
 # list of renewed certificate domains (for example, "example.com www.example.com")
 # (default: None)
 if [ -z ${RENEWED_DOMAINS+x} ]; then
  logInfo "Environment variable RENEWED_DOMAINS not defined. Skipping."
  exit 0
 fi
 {% raw %}
 RENEWED_DOMAINS_ARRAY=(${RENEWED_DOMAINS})
 if [ ${#RENEWED_DOMAINS_ARRAY[@]} -eq 0 ]; then
  logInfo "Environment variable RENEWED_DOMAINS_ARRAY is empty. Skipping."
  exit 0
 fi
 {% endraw %}
 for RENEWED_DOMAIN in "${RENEWED_DOMAINS_ARRAY[@]}"; do
  case ${RENEWED_DOMAIN} in
    "${POSTFIX_LETSENCRYPT_DOMAIN}")
    systemctl restart postfix.service
    logInfo "Systemd service restarted!"
    exit 0
  ;;
  esac
 done
@@ -0,0 +1,7 @@
 #
 # {{ ansible_managed }}
 #
 {% for item in postfix_alias_database_entries | default([]) %}
 {{ item.origin }} {{ item.user }}
 {% endfor %}
@@ -0,0 +1,9 @@
 #
 # {{ ansible_managed }}
 #
 # Replace only recipient and sender e-mail addresses.
 # http://www.postfix.org/postconf.5.html#canonical_maps
 {% for item in postfix_lmdb_canonical_maps_table_entries | default([]) %}
 {{ item.origin }} {{ item.replacement }}
 {% endfor %}
@@ -0,0 +1,11 @@
 #
 # {{ ansible_managed }}
 #
 # Search the specified access database for the client hostname, parent domains,
 # client IP address, or networks obtained by stripping least significant octets.
 # http://www.postfix.org/postconf.5.html#check_client_access
 # http://www.postfix.org/access.5.html
 {% for item in postfix_lmdb_check_client_access_maps_table_entries | default([]) %}
 {{ item.pattern }} {{ item.action }}{% if item.reason is defined %} {{ item.reason }}{% endif %}
 {% endfor %}
@@ -0,0 +1,11 @@
 #
 # {{ ansible_managed }}
 #
 # Search the specified access(5) database for the HELO or EHLO hostname or
 # parent domains, and execute the corresponding action.
 # http://www.postfix.org/postconf.5.html#check_helo_access
 # http://www.postfix.org/access.5.html
 {% for item in postfix_lmdb_check_helo_access_maps_table_entries | default([]) %}
 {{ item.pattern }} {{ item.action }}{% if item.reason is defined %} {{ item.reason }}{% endif %}
 {% endfor %}
@@ -0,0 +1,11 @@
 #
 # {{ ansible_managed }}
 #
 # Search the specified access(5) database for the resolved RCPT TO address,
 # domain, parent domains, or localpart@, and execute the corresponding action.
 # http://www.postfix.org/postconf.5.html#check_recipient_access
 # http://www.postfix.org/access.5.html
 {% for item in postfix_lmdb_check_recipient_access_maps_table_entries | default([]) %}
 {{ item.pattern }} {{ item.action }}{% if item.reason is defined %} {{ item.reason }}{% endif %}
 {% endfor %}
@@ -0,0 +1,11 @@
 #
 # {{ ansible_managed }}
 #
 # Search the specified access(5) database for the MAIL FROM address, domain,
 # parent domains, or localpart@, and execute the corresponding action.
 # http://www.postfix.org/postconf.5.html#check_sender_access
 # http://www.postfix.org/access.5.html
 {% for item in postfix_lmdb_check_sender_access_maps_table_entries | default([]) %}
 {{ item.pattern }} {{ item.action }}{% if item.reason is defined %} {{ item.reason }}{% endif %}
 {% endfor %}
@@ -0,0 +1,25 @@
 #
 # {{ ansible_managed }}
 #
 # Postfix master process configuration file.  For details on the format
 # of the file, see the master(5) manual page (command: "man 5 master" or
 # on-line: http://www.postfix.org/master.5.html).
 #
 # Do not forget to execute "postfix reload" after editing this file.
 #
 # ==========================================================================
 # service type  private unpriv  chroot  wakeup  maxproc command + args
 #               (yes)   (yes)   (no)    (never) (100)
 # ==========================================================================
 {% for service in postfix_services %}
 {% set priv = ('y' if service.private else 'n') if service.private is defined else '-' %}
 {% set unpriv = ('y' if service.unprivileged else 'n') if service.unprivileged is defined else '-' %}
 {% set chrt = ('y' if service.chroot else 'n') if service.chroot is defined else '-' %}
 {% set wkup = service.wakeup | default('-') | string %}
 {% set mproc = service.maxproc | default('-') | string %}
 {{ "%-9s %-5s %-7s %-7s %-7s %-7s %-7s %s" | format(service.name, service.type, priv, unpriv, chrt, wkup, mproc, service.command) }}
 {% for arg in service.args | default([]) %}
  {{ arg }}
 {% endfor %}
 {% endfor %}
@@ -0,0 +1,9 @@
 #
 # {{ ansible_managed }}
 #
 hosts    = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
 user     = {{ postfix_pgsql_username }}
 password = {{ postfix_pgsql_password }}
 dbname   = {{ postfix_pgsql_name }}
 query    = {{ postfix_pgsql_relay_domains_query }}
@@ -0,0 +1,9 @@
 #
 # {{ ansible_managed }}
 #
 hosts    = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
 user     = {{ postfix_pgsql_username }}
 password = {{ postfix_pgsql_password }}
 dbname   = {{ postfix_pgsql_name }}
 query    = {{ postfix_pgsql_relay_recipient_maps_query }}
@@ -0,0 +1,9 @@
 #
 # {{ ansible_managed }}
 #
 hosts    = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
 user     = {{ postfix_pgsql_username }}
 password = {{ postfix_pgsql_password }}
 dbname   = {{ postfix_pgsql_name }}
 query    = {{ postfix_pgsql_smtpd_sender_login_maps_query }}
@@ -0,0 +1,9 @@
 #
 # {{ ansible_managed }}
 #
 hosts    = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
 user     = {{ postfix_pgsql_username }}
 password = {{ postfix_pgsql_password }}
 dbname   = {{ postfix_pgsql_name }}
 query    = {{ postfix_pgsql_virtual_alias_domain_catchall_maps_query }}
@@ -0,0 +1,9 @@
 #
 # {{ ansible_managed }}
 #
 hosts    = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
 user     = {{ postfix_pgsql_username }}
 password = {{ postfix_pgsql_password }}
 dbname   = {{ postfix_pgsql_name }}
 query    = {{ postfix_pgsql_virtual_alias_domain_mailbox_maps_query }}
@@ -0,0 +1,9 @@
 #
 # {{ ansible_managed }}
 #
 hosts    = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
 user     = {{ postfix_pgsql_username }}
 password = {{ postfix_pgsql_password }}
 dbname   = {{ postfix_pgsql_name }}
 query    = {{ postfix_pgsql_virtual_alias_domain_maps_query }}
@@ -0,0 +1,9 @@
 #
 # {{ ansible_managed }}
 #
 hosts    = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
 user     = {{ postfix_pgsql_username }}
 password = {{ postfix_pgsql_password }}
 dbname   = {{ postfix_pgsql_name }}
 query    = {{ postfix_pgsql_virtual_alias_maps_query }}
@@ -0,0 +1,9 @@
 #
 # {{ ansible_managed }}
 #
 hosts    = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
 user     = {{ postfix_pgsql_username }}
 password = {{ postfix_pgsql_password }}
 dbname   = {{ postfix_pgsql_name }}
 query    = {{ postfix_pgsql_virtual_mailbox_domains_query }}
@@ -0,0 +1,9 @@
 #
 # {{ ansible_managed }}
 #
 hosts    = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
 user     = {{ postfix_pgsql_username }}
 password = {{ postfix_pgsql_password }}
 dbname   = {{ postfix_pgsql_name }}
 query    = {{ postfix_pgsql_virtual_mailbox_limit_maps_query }}
@@ -0,0 +1,9 @@
 #
 # {{ ansible_managed }}
 #
 hosts    = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
 user     = {{ postfix_pgsql_username }}
 password = {{ postfix_pgsql_password }}
 dbname   = {{ postfix_pgsql_name }}
 query    = {{ postfix_pgsql_virtual_mailbox_maps_query }}
@@ -0,0 +1,9 @@
 #
 # {{ ansible_managed }}
 #
 # Replace only recipient e-mail addresses.
 # http://www.postfix.org/postconf.5.html#recipient_canonical_maps
 {% for item in postfix_lmdb_recipient_canonical_maps_table_entries | default([]) %}
 {{ item.origin }} {{ item.replacement }}
 {% endfor %}
@@ -0,0 +1,11 @@
 #
 # {{ ansible_managed }}
 #
 # Domains that match $relay_domains are delivered with the $relay_transport mail
 # delivery transport. The SMTP server validates recipient addresses with
 # $relay_recipient_maps and rejects non-existent recipients.
 # http://www.postfix.org/postconf.5.html#relay_domains
 {% for item in postfix_lmdb_relay_domains_table_entries | default([]) %}
 {{ item.domain }} {{ item.action }}{% if item.reason is defined %} {{ item.reason }}{% endif %}
 {% endfor %}
@@ -0,0 +1,15 @@
 #
 # {{ ansible_managed }}
 #
 # Optional lookup tables with all valid addresses in the domains that match
 # $relay_domains. Specify @domain as a wild-card for domains that have no valid
 # recipient list, and become a source of backscatter mail: Postfix accepts spam
 # for non-existent recipients and then floods innocent people with undeliverable
 # mail. Technically, tables listed with $relay_recipient_maps are used as lists:
 # Postfix needs to know only if a lookup string is found or not, but it does not
 # use the result from table lookup.
 # http://www.postfix.org/postconf.5.html#relay_recipient_maps
 {% for item in postfix_lmdb_relay_recipients_table_entries | default([]) %}
 {{ item.recipient }} {{ item.action }}{% if item.reason is defined %} {{ item.reason }}{% endif %}
 {% endfor %}
@@ -0,0 +1,10 @@
 #
 # {{ ansible_managed }}
 #
 # Optional lookup tables with new contact information for users or domains that
 # no longer exist.
 # http://www.postfix.org/postconf.5.html#relocated_maps
 {% for item in postfix_lmdb_relocated_maps_table_entries | default([]) %}
 {{ item.old_address }} {{ item.new_address }}
 {% endfor %}
@@ -0,0 +1,7 @@
 #
 # {{ ansible_managed }}
 #
 {% for item in postfix_lmdb_smtp_sasl_password_maps_table_entries | default([]) %}
 {{ item.destination }} {{ item.username }}:{{ item.password }}
 {% endfor %}
@@ -0,0 +1,9 @@
 #
 # {{ ansible_managed }}
 #
 # Replace only sender e-mail addresses.
 # http://www.postfix.org/postconf.5.html#sender_canonical_maps
 {% for item in postfix_lmdb_sender_canonical_maps_table_entries | default([]) %}
 {{ item.origin }} {{ item.replacement }}
 {% endfor %}
@@ -0,0 +1,17 @@
 #
 # {{ ansible_managed }}
 #
 # Optional lookup table with the SASL login names that own the sender (MAIL
 # FROM) addresses. Used by reject_sender_login_mismatch and
 # reject_authenticated_sender_login_mismatch restrictions.
 #
 # Lookup operations for a sender address user@domain:
 # - user@domain: always done, highest precedence
 # - user: only when domain matches $myorigin, $mydestination, $inet_interfaces
 #   or $proxy_interfaces
 # - @domain: done last, lowest precedence
 # http://www.postfix.org/postconf.5.html#smtpd_sender_login_maps
 {% for item in postfix_lmdb_smtpd_sender_login_maps_table_entries | default([]) %}
 {{ item.address }} {{ item.login }}
 {% endfor %}
@@ -0,0 +1,10 @@
 #
 # {{ ansible_managed }}
 #
 # Removes information from the email header that is
 # questionable from a data protection point of view.
 {% for entry in postfix_regexp_submission_header_cleanup_table_entries | default([]) %}
 {{ entry.pattern }}    IGNORE
 {% endfor %}
@@ -0,0 +1,10 @@
 #
 # {{ ansible_managed }}
 #
 # Optional lookup tables with the Postfix SMTP client TLS security policy by
 # next-hop destination.
 # http://www.postfix.org/postconf.5.html#smtp_tls_policy_maps
 {% for item in postfix_lmdb_tls_policy_maps_table_entries | default([]) %}
 {{ item.destination }} {{ item.policy }}
 {% endfor %}
@@ -0,0 +1,10 @@
 #
 # {{ ansible_managed }}
 #
 # Optional lookup tables with mappings from mail address or domain to message
 # delivery transport and/or next-hop destination.
 # http://www.postfix.org/postconf.5.html#transport_maps
 {% for item in postfix_lmdb_transport_maps_table_entries | default([]) %}
 {{ item.pattern }} {{ item.transport }}
 {% endfor %}
@@ -0,0 +1,11 @@
 #
 # {{ ansible_managed }}
 #
 # Optional lookup tables that alias specific mail addresses or domains to other
 # local or remote address. The table format and lookups are documented in
 # virtual(5).
 # http://www.postfix.org/postconf.5.html#virtual_alias_maps
 {% for item in postfix_lmdb_virtual_alias_maps_table_entries | default([]) %}
 {{ item.source }} {{ item.destination }}
 {% endfor %}
@@ -0,0 +1,14 @@
 #
 # {{ ansible_managed }}
 #
 # Postfix is the final destination for the specified list of domains; mail is
 # delivered via the $virtual_transport mail delivery transport. By default this
 # is the Postfix virtual(8) delivery agent. The SMTP server validates recipient
 # addresses with $virtual_mailbox_maps and rejects mail for non-existent
 # recipients. See also the virtual mailbox domain class in the
 # ADDRESS_CLASS_README file.
 # http://www.postfix.org/postconf.5.html#virtual_mailbox_domains
 {% for item in postfix_lmdb_virtual_mailbox_domains_table_entries | default([]) %}
 {{ item.domain }} {{ item.action }}
 {% endfor %}
@@ -0,0 +1,14 @@
 #
 # {{ ansible_managed }}
 #
 # Optional lookup tables with all valid addresses in the domains that match
 # $virtual_mailbox_domains. Specify zero or more "type:name" lookup tables,
 # separated by whitespace or comma. Tables will be searched in the specified
 # order until a match is found. In a lookup table, specify a left-hand side of
 # "@domain.tld" to match any user in the specified domain that does not have a
 # specific "user@domain.tld" entry.
 # http://www.postfix.org/postconf.5.html#virtual_mailbox_maps
 {% for item in postfix_lmdb_virtual_mailbox_maps_table_entries | default([]) %}
 {{ item.address }} {{ item.action }}
 {% endfor %}
@@ -0,0 +1,12 @@
 #
 # {{ ansible_managed }}
 #
 [Unit]
 Description=Unit to execute a notification service for systemd logfiles
 Requires=network-online.target
 After=network-online.target
 [Service]
 Type=simple
 ExecStart=/usr/local/sbin/systemd-email.sh markus.pesch@cryptic.systems %i
@@ -0,0 +1,9 @@
 #!/bin/bash
 #
 # {{ ansible_managed }}
 #
 TIMESTAMP="$(systemctl show "${2}" -p AssertTimestamp | awk '{print $2 " " $3;}')"
 journalctl --unit "${2}" --since "${TIMESTAMP}" | gpg --auto-key-locate clear,nodefault,wkd --trust-model always --encrypt --armor --recipient "${1}" | mail -s "${2}" "${1}"